Phishing-as-a-Service has industrialised faster than most defenders expected. The May 2026 picture is meaningfully more sophisticated than the equivalent twelve-month-ago picture, with structural shifts in the ecosystem that defenders need to track even if the specific operations are short-lived.

The basic business model is mature. PhaaS operators sell or rent phishing infrastructure to less-skilled criminals, taking a cut of the proceeds or a flat subscription fee. The customer-facing operators don’t need to build credential-harvesting kits, host infrastructure, or manage the bypass of common defensive controls. They subscribe to a service that handles all of that, focus on social engineering and target acquisition, and operate at scale they couldn’t reach if they had to build their own toolkit.

What’s changed in 2026: the AI-augmented PhaaS offerings have become the dominant pattern. The 2024 generation of these services started incorporating LLM-driven content generation. The 2026 generation has integrated multiple AI capabilities. Real-time generation of pretext content tuned to the specific target. Voice-clone capability for follow-up phone-based social engineering. Image generation for credible spoofed website assets. Translation that’s good enough to reach non-English-speaking targets credibly.

The MFA-bypass capability has also matured. Adversary-in-the-middle phishing kits that intercept session cookies after MFA completion have become the default rather than the advanced offering. The combination of these kits with the AI-augmented social engineering produces credential-and-session theft rates that traditional MFA-as-a-control assumptions don’t account for.

The distribution side has industrialised too. Bulletproof hosting, domain rotation infrastructure, and traffic distribution networks supporting these operations have organised into stable supplier relationships. Disrupting the infrastructure is harder than it was in earlier years because the supplier relationships are more redundant and the operational pattern adapts quickly to takedown actions.

What this means for defenders: the assumption that MFA closes the credential phishing risk is wrong in 2026. Phishing-resistant MFA — primarily FIDO2 hardware keys and platform passkeys — does provide meaningful uplift over OTP-based MFA, and organisations that have moved to passkey-based authentication for high-risk accounts have measurably reduced their phishing exposure. Organisations still relying on SMS or app-OTP MFA face elevated risk.

The detection side has also evolved. Email security gateways with AI-driven content analysis are doing real work. The detection rate for AI-generated phishing content has improved meaningfully over the past year as the security vendors have caught up to the offensive AI capabilities. The detection isn’t perfect — sophisticated AI-generated phishing still reaches inboxes — but the baseline detection has improved.

User-behaviour analysis is increasingly important. The pattern of detection that works in 2026 isn’t “the email looks suspicious” so much as “this user is doing something out of pattern in a session that started from a suspicious context.” The lift from behavioural detection on top of content-based email security is significant, and the better organisations are running both.

The security awareness training conversation has moved on. The 2024 advice — “look for these signs in suspicious emails” — has lost much of its operational value in 2026. The signs that 2024 training programs taught users to look for are exactly the signs that the AI-augmented phishing kits no longer produce. The 2026 awareness programs that work focus less on visual content cues and more on procedural cues: did the request follow the normal channel, did the request go through the normal verification, does the request align with normal patterns of operation. These cues are harder for the attacker to manipulate.

The credential rotation conversation matters more in 2026 than it did before. Organisations with strong credential lifecycle management — short-lived sessions, fast token revocation, high-confidence reauthorisation for sensitive operations — limit the blast radius of successful phishing more effectively. The combination of phishing-resistant authentication with disciplined session and credential management is the defensive position that’s actually working in 2026.

For Australian organisations evaluating their phishing posture in 2026, the practical actions are: complete the migration to passkey-based MFA on high-risk roles, invest in behavioural detection on top of content-based email security, update awareness training to reflect the procedural-cue approach, and tighten credential lifecycle management. The 2024 defensive posture is not adequate against the 2026 offensive capability. The gap is closable but it requires actual work rather than buying more of the same tooling.

The honest bottom line: phishing in 2026 is more capable, faster-moving, and more accessible to less-skilled attackers than it was even eighteen months ago. The defensive uplift required is real, and the organisations that haven’t done it are increasingly outmatched.