• Email-borne attacks are increasing, Proofpoint survey finds
  • AI-powered apps are creating visibility and identity control problems
  • Hospitality and healthcare industries particularly hit

New analysis frommProofpoint has claimed cybersecurity threats are speeding up in Europe faster than anywhere else in the world.

Organizations on the Old Continent are facing increasing numbers of email attacks, rising interest from both state-sponsored and profit-oriented groups, and growing malware infections that don’t discriminate based on industry, organization size, or any other meaningful metric, the company found.

Industries and technologies

In its report, Proofpoint first points the finger at email. This year, its telemetry detected 4.5 times more phishing emails compared to 2025 while, for the rest of the world, that growth has been more modest - 1.5 times. Detections per million inbound messages rose 3.2 times across Europe, it said.

Business Email Compromise (BEC) attacks are of particular concern, it seems. These attacks happen when attackers compromise someone’s business email, assume their identity, and reach out to their colleagues, partners, or clients with a seemingly legitimate request. That request usually means wiring funds to an attacker-controlled account, or granting access to valuable business software and data.

Looking at BEC threats specifically, Proofpoint said European electronics companies receive 3.4 times more of these emails than the European average, with supply-chain invoice fraud being the most common pattern.

There are “considerable” variations per industry, the report states. Hospitality and leisure are primarily targeted with malware (21% of all detections, compared to 11% worldwide). Telephone-oriented attack delivery, or callback phishing, has also risen 262% year-on-year. Healthcare organizations are also a major target. TOAD targeting companies in this industry rose 257% compared to 2025, while malware increased 84%. At the same time, malware attacks across Europe are actually declining.

Proofpoint hints as to why Europe seems to be a particular target - people there are more responsive. Apparently, for every 100 threat emails delivered, there were 8.3 clicks, compared to 2.0 worldwide.

The key players remain the same, although there have been a few new - and notable - additions. The researchers primarily mention established Russian and Chinese threat actors who have, over the year evolved their techniques in gaining and maintaining access to European organizations. That includes TA395 (“one of the most prolific actors observed in Proofpoint telemetry”) and TA488, (known for targeting Outlook, Zimbra, and other webmail providers).

However, they also mention India and Pakistan who, historically, were more preoccupied targeting each other. In 2026, it seems, they are shifting their focus on Western Europe, as well.

Artificial Intelligence (AI) isn’t helping, either. Proofpoint says it observed more than 188,000 AI-enabled applications connected through authentication and OAuth frameworks, and while these apps can automate workflows and access APIs and enterprise services at machine speed, they are also opening up visibility and identity control challenges and risks.

Targeting AI building blocks

As a result, threat actors are now also targeting the very mechanisms that enable connectivity - meaning content grants, tokens, and applications with misconfigured privileges.

Almost all (99%) of European organizations observed were targeted by cloud-based attacks, with precision attacks (phishing and session hijacking) proving particularly effective. These attacks impacted 64% of targeted organisations in Europe, proofpoint stressed.

The attackers also going after open source AI technologies such as Langflow and LiteLLM, it was said. “The share of European sensors affected by attacks targeting these AI building blocks increased 4.6× between consecutive 90-day periods, demonstrating how AI infrastructure itself is becoming an increasingly attractive target,” Proofpoint warned.

Breaking in is just means to an end, it seems Across Europe, almost four in five victims (72%) saw threat actors working hard to maintain access, manipulate authentication controls, access files, or abuse compromised mailboxes.