Most companies think phishing looks the same as it did five years ago. A suspicious email with a dodgy link making you feel something is slightly off. That version of phishing still exists. But it is no longer the version targeting your employees.

Do you know? 86% of phishing attacks are now AI-driven and those attacks rose 17.1% over the previous six months.

Your email inbox is no longer even the main battlefield!

Here is what actually changed and why it matters for companies in Singapore.

Why Phishing Attacks Peak at 5pm During The End-of-Day Blur

Research found that phishing attack volumes start climbing at 1pm and peak at 5pm, with 4,119 campaigns started in a single hour at the close of business. This is not accidental! They deliberately target the end of the day because that is when your cognitive load is highest and scrutiny is lowest. (Also known as the “End-of-Day Blur”: the window when employees are wrapping up, mentally drained, and far less likely to pause before clicking)

This tells you a lot about how the attackers are studying human behaviour and timing their attacks around psychological vulnerabilities. A well-crafted phishing email sent at 5pm on a Friday gets clicked more often than the same email sent on a Tuesday morning.

AI Phishing Is Seven Times More Efficient Than Manual Attacks

86% of phishing attacks in the first half of 2026 were AI-driven. So how are attackers actually using AI to build their campaigns?

1. The Research Stage Takes Minutes Now

In the past, doing recon on a target took hours. Attackers had to manually stalk someone to figure out their role, colleagues, active projects, and software.

Now? AI does all that research in minutes, at scale, across thousands of victims simultaneously.

2. Every Single Email Is Unique (Polymorphic Phishing)

Because AI customizes everything so no two phishing emails look the same. Subject lines, text, file signatures, and sender info change for every single recipient.

This completely breaks standard email filters. Security tools rely on matching known bad patterns and when every email is different, the filter sees nothing to flag.

3. Emails Are Getting Longer (and Way Harder to Spot)

Instead of short, obvious spam, AI writes full narratives to build trust before asking for a single thing. The average phishing email size basically doubled from 497 characters in 2022 to 1,011 characters in 2026.

This makes Business Email Compromise (BEC) much trickier, because AI can perfectly copy a CFO’s actual typing style instead of sending a sloppy payment request.

Technical controls are necessary, but they are not sufficient… Attackers have changed their phishing attack methods. The human layer needs training that reflects what attacks actually look like in 2026, not 2022.