MalwarePublished 22 Apr 2026

March 2026 Phishing Email Trends Report

Source AlienVault OTX General

Description

In March 2026, trojans represented 21% of attachment-based threats, while phishing attacks using fake pages dropped from 42% to 15% month-over-month. Script-based malware increased significantly, with HTML at 14% and JavaScript at 11%. Compressed files including ZIP (14%), RAR (8%), and 7Z (5%) were common distribution methods. Document-based threats utilized PDF (13%), XLS (5%), and DOCX (2%) files. Attackers impersonated courier services like FedEx and DHL, as well as financial institutions including Hana Bank and Woori Bank. Distribution methods included HTML scripts and PDF hyperlinks leading to credential-stealing pages. Notable malware families included RemcosRAT and AgentTesla, with command-and-control infrastructure utilizing Telegram API tokens and external mail servers for data exfiltration.

Impact

The impact involves increased phishing and malware campaigns that can lead to credential theft and unauthorized access through trojans and script-based malware. The use of trusted brand impersonation increases the likelihood of successful social engineering attacks. Data exfiltration via command-and-control infrastructure using Telegram API tokens and external mail servers can compromise sensitive information. There are no known exploits in the wild targeting specific software vulnerabilities, and no direct patch or remediation is applicable.

Defensive guidance

Since this report describes phishing and malware campaign trends rather than a specific software vulnerability, no direct patch or official fix is applicable. Organizations should focus on user awareness training to recognize phishing attempts, implement email filtering to detect malicious attachments and scripts, and monitor for indicators of compromise related to RemcosRAT and AgentTesla malware. Employing multi-factor authentication can reduce the risk of credential theft exploitation.

Summary

This report details phishing email trends observed in March 2026, emphasizing the prevalence of trojans in attachment-based threats and a decline in phishing via fake pages. Script-based malware attacks using HTML and JavaScript increased notably. Attackers commonly used compressed files and document formats to distribute malware. Impersonation of courier and financial services was a key social engineering tactic. Malware families RemcosRAT and AgentTesla were identified, leveraging Telegram API tokens and external mail servers for command-and-control and data exfiltration. The report does not indicate any specific software vulnerabilities or exploits, nor does it reference patches or vendor advisories.

Indicators of compromise

Domains 2

controller.airdns.org
ccp11nl.hyperhost.ua

Hashes 5

06dc18771404694814d6a430bb65d1a3
0a15c9a545fbf78d77f8c130a3b0f840
0a18f61e8d8e9873cdda4b3b6785d7ad
0d15bf48b73de307eff29f07a6e6d55b
0e9bd0c9991b21b13eddb518dee0eecf

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Apr 2026, 09:03 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 2

Hashes 5

Community reviews

Related threats