AI scams overtake phishing as cybercrime turns into an industrialised business

Online scam detections doubled to 6.4 million as attackers exploit brand trust, automate fraud and shrink phishing attack lifespans to just 22 days, Akamai report finds.

Cybercrime is undergoing a fundamental shift. Instead of relying predominantly on conventional phishing attacks to steal passwords and credentials, fraudsters are increasingly building multichannel operations that manipulate consumers into making payments, downloading malicious applications and surrendering sensitive personal information.

The scale of this transformation is reflected in Akamai’s State of the Internet: AI-Driven Digital Deception – The Fraud and Abuse Report 2026 . According to the report, online scam detections approximately doubled from 3.2 million to 6.4 million, overtaking traditional phishing for the first time in the first quarter of 2026. Traditional phishing, meanwhile, continued to expand, recording 61% growth by the second quarter.

The findings point to a changing cybercrime economy in which attackers are no longer interested only in gaining unauthorised access to accounts. They are increasingly focused on extracting money directly through fake stores, investment scams, technical support fraud, payment deception and impersonation campaigns.

From phishing links to an industrialised fraud ecosystem

One of the most significant developments is the growing sophistication of the infrastructure supporting these operations.

The industrialisation of these operations is particularly concerning. In one retail campaign, researchers identified more than 1,200 look-alike .shop domains sharing a single IP address and reusing similar HTML, JavaScript and payment-page designs to harvest card numbers, expiry dates and security codes.

This points to a criminal infrastructure in which websites, phishing templates and payment collection mechanisms can be replicated at scale rather than built independently for every attack.

Artificial intelligence is accelerating the process. Attackers are using AI to generate dynamic templates, create multilingual messages and personalise fraudulent communications, allowing campaigns to reach wider audiences while adapting to security controls.

The window available to security teams is also shrinking. The average lifespan of a phishing attack fell from 48 days in the fourth quarter of 2025 to just 22 days in the second quarter of 2026, a decline of more than 50%.

This rapid infrastructure rotation makes conventional, reactive security measures increasingly inadequate. By the time an organisation identifies and blocks a malicious domain, attackers may already have shifted operations to another.

Asia-Pacific faces a growing account-abuse challenge

The regional findings underline the importance of the threat for Asia-Pacific businesses.

In a 30-day sample of login activity analysed by Akamai, the region accounted for 25.1% of recorded login attempts. More significantly, 36.4% of login attempts in APAC were classified as high or critical risk, compared with 23.6% in North America and 23.7% in Europe, the Middle East and Africa.

The report also found that account verification requests represented 40% of high- and critical-risk login activity. Such requests may indicate that attackers are checking whether email addresses correspond to legitimate accounts before launching credential-stuffing campaigns.

A case involving a large financial institution in APAC illustrates how these attacks can operate at different scales. During the week beginning July 29, 2026, researchers observed approximately 42,000 requests from a botnet attempting to validate personally identifiable information. At the same time, a separate low-volume campaign generated 164 requests, potentially to establish accounts for money-mule activity or synthetic identity fraud.

The contrast is important. While large-scale attacks can generate obvious warning signals, smaller campaigns may deliberately remain below detection thresholds.

Brand trust becomes the new attack surface

The report identifies brand impersonation as another major component of the evolving threat landscape.

Between January and July 2026, high-technology brands accounted for 41.6% of malicious domains impersonating enterprise brands, followed by financial services at 18.9% and commerce at 8.4%.

Attackers are exploiting familiar logos, cloned login pages, fake customer-service portals and spoofed payment interfaces to make fraudulent interactions appear legitimate.

The consequences extend beyond stolen credentials. A compromised retail account can be used to make unauthorised purchases, drain loyalty points or redirect refunds. In financial services, attackers can change information, add beneficiaries and divert payments into money-mule accounts.

Even major sporting events have become opportunities for organised fraud. Akamai researchers identified a coordinated ticket-impersonation campaign involving 12 unique hostnames and 20 captured website instances. The cloned portals directed users through fake purchase journeys designed to collect payment-card details, personal information and, in some cases, passport or identity-document details.

The stolen information can subsequently support identity fraud, account takeovers and further financial scams.

The challenge: Securing an AI-driven internet

The emergence of autonomous AI agents introduces another layer of complexity. As consumers increasingly interact with businesses through AI platforms, rather than visiting websites directly, organisations must account for automated agents that can , transact and access services on behalf of users.

Akamai warns that this evolving agentic web creates new vulnerabilities involving synthetic identities, application programming interfaces and Model Context Protocol endpoints.

The report argues that cybersecurity can no longer remain confined to conventional network protection. Organisations need to bring cybersecurity, fraud prevention, finance, marketing, customer experience and compliance teams together to identify threats across the entire customer journey.

Its recommendations include behavioural bot detection, stronger API protection, automated investigations, monitoring of shared phishing infrastructure, controls against fake account creation and improved governance of AI-agent identities.

The larger message is that digital trust has become an economic asset, and increasingly, a target. As cybercriminals industrialise deception and AI accelerates their operations, protecting businesses will require more than blocking malicious links or strengthening passwords. It will require identifying fraudulent intent before a seemingly legitimate digital interaction turns into a financial loss.