Phishing Attacks in October 2026: Monthly Report
Quick Summary
In October 2026, Breachsense collected 144,695 credentials stolen by phishing kits, from 83,298 email addresses across 24,979 domains. Of the 83,298 email addresses, 40,899 were work email addresses. For 40,498 of the work addresses (99%), our breach records and combo lists didn’t contain the phished password. Ask your credential monitoring vendor whether it collects passwords stolen by phishing kits.
Phished passwords rarely show up in breach data
Of the 83,298 email addresses in the phished credentials we collected in October, 40,899 were work email addresses. For 40,498 of the 40,899 work addresses (99%), the phished password wasn’t in any of our breach records or combo lists. In September, the figure was 98.9%.
Our numbers are based on the phishing kit infrastructure we can access, so they don’t cover every phishing site in operation.
Why listen to us?
Breachsense is a dark web monitoring API. Alongside stealer logs and breach data, we collect the credentials phishing kits steal. We hold over 42 billion leaked credentials. We checked October’s phished passwords against our breach records and combo lists. Josh Amishav, our founder, worked as a penetration tester for nearly 20 years. He got into client networks with leaked credentials. Lawyers cited our breach records in the Academy Mortgage class action complaint.
October 2026 phishing numbers at a glance
- 144,695 credentials collected from phishing kits, from 83,298 email addresses across 24,979 domains
- 985 kit hosts, meaning separate hostnames serving a phishing kit
- 40,899 work email addresses with a phished password
- Microsoft was the most impersonated brand, at 54.8% of credentials where the kit recorded a brand
We collected 144,695 phished credentials in October, up from 92,663 in September. The October credentials came from 83,298 email addresses, up from 49,502 in September.
Vercel hosted the phishing kits behind the most credentials
| Platform | Credentials | Share | Kit hosts |
|---|---|---|---|
| Vercel (vercel.app) | 18,399 | 12.7% | 82 |
| EdgeOne Pages (edgeone.dev) | 12,529 | 8.7% | 153 |
| Backblaze B2 (backblazeb2.com) | 9,393 | 6.5% | 15 |
| Netlify (netlify.app) | 7,917 | 5.5% | 46 |
| IPFS (InterPlanetary File System) gateways | 7,053 | 4.9% | 31 |
| Cloudflare Pages (pages.dev) | 5,839 | 4.0% | 36 |
Phishing kits on IPFS gateways stole 5% of the credentials we collected
Kits hosted on IPFS stole 7,053 credentials for 5,771 email addresses. The kits ran on 31 IPFS gateway hosts. 27 of the 31 hosts were subdomains of inbrowser.link. A phishing page on IPFS isn’t hosted on one website. Any public IPFS gateway can display the phishing page at the gateway’s own address. If one gateway removes the phishing page, the same page still loads through a gateway run by someone else.
A GitHub Pages phishing kit stole passwords from 17 Luxembourg government staff
A GitHub Pages kit stole passwords from 17 staff between October 15 and 21. All 17 had addresses at etat.lu, the Luxembourg government’s email domain. A kit on Vercel collected passwords from 35 staff at RE/MAX Portugal in 16 minutes on October 30. At Uzbekistan Airways, a kit in an Amazon S3 bucket phished 17 staff in three minutes on October 20.
Microsoft and Google were the most impersonated brands
Kits recorded which brand they were impersonating for 21,063 credentials, 15% of everything we collected.
| Brand | Share of credentials where the kit recorded a brand |
|---|---|
| Microsoft | 36.0% |
| Outlook | 18.0% |
| Adobe | 10.4% |
| 9.9% | |
| Gmail | 9.7% |
| DocuSign | 6.9% |
| 3.1% |
With Outlook (18.0%) and Office 365 (0.8%) included, Microsoft’s share is 54.8%, or 11,538 credentials. With Gmail (9.7%) included, Google’s share is 19.6%. In September, Microsoft’s share was 71.6%. 8,405 of the 11,538 Microsoft credentials (72.8%) were for personal Hotmail, Outlook.com, Live and MSN addresses.
What security teams should do
Ask your credential monitoring vendor whether it collects passwords stolen by phishing kits. Our breach records and combo lists contained the phished password for only 401 of the 40,899 work addresses we checked in October.
Block public IPFS gateway domains, such as inbrowser.link and ipfs.io, at your web proxy if nobody at your company uses IPFS. Phishing kits on inbrowser.link stole 7,025 of the 7,053 IPFS-hosted credentials.
How we collected this data
We count each credential in the month we indexed it.
We drop entries that aren’t real victim data. Security scanners submit made-up addresses to phishing pages. Some kits also get flooded with fake entries.
Work email addresses exclude webmail and internet provider domains, such as gmail.com or comcast.net.
We count each hostname that served a phishing kit once, even a shared storage hostname such as storage.googleapis.com that served several kits.
Find out which of your employees were phished
Dark web monitoring sends you an alert by webhook or email when we find one of your employees’ passwords in a phishing kit.
Breachsense is a dark web monitoring API for security teams and MSSPs. It finds credentials and session tokens that have already been stolen from your staff or customers, whether by infostealer malware or a phishing page. It sends those credentials and tokens by webhook, so teams can reset the affected accounts before attackers use them. It also indexes the files ransomware groups leak, so you can search them for your own company’s data.
To see what has already leaked for your domain, run a free dark web scan, then book a demo to set up alerts.
Our October 2026 infostealer report covers the stealer logs we indexed that month. The October 2026 ransomware report counts the companies ransomware groups listed on their leak sites. For the previous month’s phishing numbers, see the September 2026 phishing report.