Phishing is the cyber threat closest to most people right now, and AI is making it harder to spot. Phishing means emails or messages that trick people into clicking a link. It remains the main way attackers get in. The Thailand Computer Emergency Response Team (ThaiCERT) lists 3,264 threat incidents detected from January to September 2026. A European Union report also names phishing as the most common way into systems. Individuals, businesses and agencies in Thailand, including foreign residents and workers, can all be targeted, so it helps to know how the threat works and where to block it.
ThaiCERT's 2026 threat figures
As of 27 October 2026, ThaiCERT's monthly statistics for 2026 show 3,264 incidents, covering January to September. They are grouped by type of threat: Intrusion Attempts (1,138), Information Content Security (1,085), Fraud (529), Availability (334), Malicious Code (136) and Intrusions (42).
ThaiCERT's table does not list phishing or ransomware as separate categories. It is therefore not possible to say how many incidents in Thailand were phishing, ransomware or AI-assisted. The figures above cover all types of threats. They are not incidents caused directly by AI or phishing. The table also has no data from October onward, so the numbers cover only the first nine months of the year.
European report: AI is making phishing more convincing
The European Union Agency for Cybersecurity (ENISA) published its ENISA Threat Landscape 2025 report on 1 October 2025. It analysed 4,875 incidents between 1 July 2024 and 30 June 2025. Phishing, including vishing (voice phishing), malspam (malicious spam email) and malvertising (malicious advertising), was the initial way in for about 60% of the cases observed. Exploiting system vulnerabilities came next at 21.3%.
ENISA says large language models (LLMs) are being used to improve phishing and to automate social engineering, which means manipulating people into giving up access or information. It reports that by early 2025, AI-assisted phishing campaigns made up more than 80% of the social engineering activity observed worldwide.
In practice, a fake email with natural wording that matches the recipient's job may no longer be unusual. Odd language should not be the only test for spotting a fake message.
The same report says ransomware, which locks data and demands payment, had the greatest impact in the EU. DDoS attacks, which flood a service with traffic to knock it offline, were the most common type of incident at 77% of those reported. Most were carried out by hacktivist groups. These figures describe Europe, not Thailand. They still show the direction of threats that businesses and users in Thailand also need to prepare for.
Defences that security agencies recommend
The #StopRansomware guide was produced by US agencies: CISA, MS-ISAC, the NSA and the FBI. It lists many ways to defend against ransomware. These are the steps ordinary users and businesses can start on right away:
- Keep backups of important data offline and encrypted, and test restoring them from time to time.
- Update software and operating systems to the latest version, starting with systems that connect to the internet.
- Turn on multi-factor authentication (MFA) for all services, choosing a type that resists phishing.
- Train users on cyber threats and use email filtering alongside the training.
- Do not expose services such as remote desktop directly to the internet.
- Give users only the access their work needs, and keep administrator accounts separate from everyday accounts.
Because ENISA found phishing to be the main way in, user training and MFA address the problem most directly. Even if someone types a password into a fake page, the account still has another layer of protection. Backups mean an organisation does not have to pay a ransom to get its data back if the data is encrypted.
Government agencies and organisations in Thailand can also consult guidance from the National Cyber Security Agency (NCSA). Its document Guidelines Prevention Ransomware and Data Leakage sets out basic practices for preventing ransomware and data leaks. It is published through the ThaiCERT website.
Source: Thailand Computer Emergency Response Team (ThaiCERT), monthly threat statistics for 2026, and National Cyber Security Agency (NCSA) guidance; European Union Agency for Cybersecurity (ENISA), ENISA Threat Landscape 2025; #StopRansomware guide by CISA, MS-ISAC, the NSA and the FBI.
This article is adapted from ViewNews' Thai-language report.
