Phishing season: what Canberra workers, job seekers and professionals need to know about cybersecurity

A wave of targeted phishing campaigns has hit Canberra's professional community over the past two months, according to cybersecurity trainers and HR consultants the Daily Canberra spoke with. The attacks, which spoofed internal IT helpdesk emails and fake job offers from legitimate-seeming firms, have duped at least a half-dozen white-collar workers in the city's consulting and government-contracting sector since April 2026.

The timing is no accident. Canberra's workforce is one of the most credential-heavy in the country-professionals routinely hold multiple digital identities for federal databases, client portals and remote-access VPNs. Each one is a potential entry point. "The threat surface here is enormous," said Angela Tran, a former Australian Signals Directorate analyst who now runs a Canberra-based cybersecurity awareness firm. Tran added that most breaches start not with sophisticated code, but with a plausible email sent at the right moment.

Why the spike matters now

The shift to hybrid work, which took hold in Canberra during the COVID years, has permanently blurred the line between personal and corporate devices. According to the Australian Cyber Security Centre's 2025-26 annual threat report, released in May, the number of self-reported cyber incidents in the ACT rose 28% compared to the previous fiscal year. The largest jump came in a category the ACSC calls "credentials harvesting"-exactly the type of attack that targets busy professionals who reuse passwords across platforms.

Job seekers are particularly exposed. Several recruitment agencies in Civic and the inner south told the Daily Canberra they have seen candidates receive fake offers that request identity documents and bank details before a formal interview. One agency, based on London Circuit, said it now includes a security warning in every initial email to applicants.

What professionals can actually do

Canberra's tech community has started to treat cybersecurity competence as a professional qualification. Meetups such as the monthly "SecureCBR" gathering, which rotates between venues in Braddon and Kingston, now draw over 100 attendees. The organisers, a coalition of local MSPs and former intelligence staff, focus on practical steps: enabling multi-factor authentication on every work account, using a password manager, and verifying any unexpected request for payment or credentials with a phone call. None of these measures are new, but they are inconsistently applied. "The gap between knowing and doing is where most of the risk lives," Tran said.

For now, the advice from local cybersecurity professionals is blunt: don't click links in unsolicited messages, even when they look internal. Canberra workers should treat any request for login credentials or personal data with the same caution they would a stranger asking for keys to the office. The next phishing email might not look like a Nigerian prince-it might look exactly like an email from payroll.