Internal team impersonation was present in 30% of phishing attacks by threat actors in Q1 2026.