Report | Cyber Security Report, 2026 | Check Point Software

Report | Cyber Security Report, 2026

ANNUALEDITION14thCYBER SECURITYREPORT 2026

01 INTRODUCTION

LOTEM FINKELSTEIN VP Research
In 2025, the threat landscape evolved rapidly, becoming more interconnected and challenging to manage. Our analysis of global telemetry and incidents reveals a fundamental shift, marked by the emergence of new attack surfaces and techniques. Attackers are integrating AI, identity abuse, exposure exploitation, and ransomware into their campaigns. The most significant change is the accelerated pace and scale at which attack opportunities are being executed. Data indicates that attackers are linking access, execution, and impact across various domains, from AI-driven social engineering and automation to the transformation of ransomware into a data-driven extortion economy. Edge devices and exposed infrastructure are increasingly used as launch points.

These patterns were consistently observed across regions and industries in 2025, highlighting the swift combination of techniques to create tangible impacts. AI exemplifies this transformation. This report views AI as a force multiplier that enhances targeting, scale, and adaptation in attacker activities, while also influencing risk prioritization and operational responses. Our report is structured around attacker behavior and real-world data. The subsequent chapters delve into where attackers are focusing their efforts, how different techniques reinforce each other, and which exposure patterns most frequently lead to impact. This provides the necessary context to understand the trajectory of the threat landscape and what will be most critical in 2026. I invite you to explore the data and findings presented in this report. Lotem Finkelstein, VP Research

02 CYBER SECURITY TRENDS

BEYOND EMAIL: MULTI-CHANNEL SOCIAL ENGINEERING

Which attack surface is the easiest to exploit across all organizations? For attackers in 2025, the answer was the human component. In social engineering attacks, threat actors attempt to achieve compromise by manipulating human victims into providing initial access. The attackers target employees, outsourced personnel, and third-party service providers to gain access to the organization’s systems or sensitive information. Although these attacks are perceived to be less serious than those exploiting software or hardware vulnerabilities, they can be just as damaging.

For years, phishing emails served as the primary social engineering vector. However, by 2025, social engineering expanded beyond traditional campaigns, employing multi-platform, cross-channel, and targeted approaches that leverage phone calls, messaging applications, and real-time impersonation. Attackers have evolved how email and browser-based social engineering attacks are executed, shifting toward interaction-driven techniques such as ClickFix. These methods guide users through seemingly legitimate workflows designed to bypass security controls and inadvertently execute malware, contributing to several high-impact business breaches.

ClickFix: Social Engineering That Shifts Execution to the User
ClickFix emerged as one of the most significant social engineering techniques in 2025. First observed in 2024, ClickFix is an initial access method in which attackers manipulate users into executing malicious actions by presenting fraudulent instructions. These instructions, typically delivered through compromised or attacker-controlled websites or emails, resemble routine verification steps. By appearing legitimate, users are manipulated into executing attacker-controlled content that delivers malware.

This technique exploits user trust and the tendency to follow technical instructions. It proved highly effective due to its simplicity, scalability, and ability to bypass security controls, as malicious actions are executed manually by users rather than through traditional file-based infection chains. In 2025, ClickFix activity increased by 500% compared to the previous year and was found in nearly half of all documented malware campaigns. The technique has been widely adopted across the threat landscape, including by established cyber criminal groups behind major operations.

Voice-Based Social Engineering – The Weapon of Choice for Major Attacks

Voice phishing and impersonation gained significant traction in 2025, proving to be a highly effective means to exploit user trust. Threat actors posed as trusted figures and used rehearsed scripts to pressure victims into resetting credentials or granting network access. Voice-based impersonation evolved into an enterprise-focused intrusion technique used to gain initial foothold in large organizations, enabling data theft and extortion.

High-impact incidents in 2025 showed how voice-driven social engineering facilitated major enterprise intrusions. For example, Scattered Spider compromised British retailer Marks & Spencer’s network through a targeted social engineering operation supported by extensive reconnaissance. The attackers used impersonation to trick a support engineer into resetting their password, culminating in the deployment of ransomware.

Victim-Initiated Social Engineering

In 2025, there was a growing trend of victim-initiated social engineering, where attackers encouraged their targets to initiate contact. For instance, attackers abusing organizations’ public “Contact Us” pages engaged employees in weeks-long exchanges before delivering a malicious attachment. This method benefitted from increased credibility and the likelihood of compromise.

Social Engineering Activity on Business Communication Platforms

Threat actors expanded their social engineering activities beyond email to messaging apps and enterprise collaboration platforms such as Microsoft Teams and Slack. These platforms provided attackers a trusted environment to impersonate internal staff and engage employees directly.

THE 2025 RANSOMWARE ECOSYSTEM

The number of ransomware victims reached record highs in 2025 with rapid changes among top ransomware groups. The year began with significant exploitation by Cl0p, followed by the disappearance of several major RaaS groups. However, ransomware activity continued to rise, displaying the resilience of affiliates.

In 2025, ransomware operations increasingly incorporated AI into various stages of the attack lifecycle. Over 7,960 victims were named on data-leak sites, marking a 53% year-over-year increase.