Netcraft forecasts legacy system risks & advanced AI threats by 2026

Netcraft has outlined five predictions for the evolving cyber threat landscape in 2026, highlighting persistent vulnerabilities stemming from legacy systems, seasonal event-driven crime, and increased complexity in fraud detection influenced by Phishing-as-a-Service and AI advancements.

Netcraft anticipates that the end of support for Windows 10 in October 2025 will leave substantial numbers of unpatched systems vulnerable to exploitation throughout 2026. Many organisations and individuals are expected to delay upgrading operating systems, creating opportunities particularly for attackers targeting sectors dependent on older or specialised infrastructure.

Netcraft's security researchers expect that seasonal triggers and large-scale events will create surges in cybercrime, with attackers exploiting occasions such as tax deadlines, the 2026 Winter Olympics, and the U.S. midterm elections for social engineering campaigns. The report also predicts that threat actors will increasingly target holiday travel and hospitality brands in large-scale scams, while scam call operations and fake investment platforms continue to expand.

The convergence of financially motivated and ideologically driven cybercriminal groups, typified by partnerships like that of DragonForce and Scattered Spider, is expected to intensify. Collaboration across ransomware and hacktivist groups is seen as a continuing trend.

Industries with extensive downstream reach, such as managed service providers, insurance, and consulting, are expected to remain attractive targets for cyber attackers looking to exploit supply chain relationships. Fintech companies, particularly those involved with under-regulated assets and crypto markets, face anticipated challenges in advancing their security maturity. Logistics, shipping, and retail may see attackers leveraging tariff and shipping-themed phishing lures.

AI system vulnerabilities

Netcraft points to the evolution of AI from simple chatbots to more autonomous agents as a source of new security and data integrity challenges. The increased complexity in these systems heightens the risk of data leakage, manipulation of workflows, and unauthorised access to sensitive data. Attackers may use AI agents to facilitate reconnaissance, automate elements of ransomware operations, or potentially exploit vulnerabilities within the AI systems themselves.

According to Netcraft, Phishing-as-a-Service is expected to proliferate further after showing marked growth in 2025. The trend reduces barriers for cybercriminals, allowing for more organised and widespread phishing campaigns. Netcraft also notes the expansion of OAuth phishing, where attackers manipulate users into granting malicious app access, bypassing the need to steal credentials directly. This method is likely to spread to additional online platforms year.