Akamai says online scams overtake phishing attacks

Akamai has published a report showing that online scams have overtaken traditional phishing attacks, adding to concerns about the use of artificial intelligence in fraud and cybercrime.

Its latest State of the Internet study found that scam detections roughly doubled from about 3.2 million to 6.4 million in the first quarter of 2026. That marked the first time online scams outnumbered conventional phishing. The study also found that the average lifespan of phishing attacks fell sharply, from 48 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026.

The report points to a shift in attacker methods, with criminal groups using automation and AI to rotate domains more quickly, evade blocklists and target a wider range of digital touchpoints. Rather than focusing only on stealing login details through classic phishing emails, attackers are increasingly using fake retail websites, spoofed portals and social recruitment traps to exploit consumer trust and business brands.

That pattern is particularly relevant as the UK government pushes ahead with plans to strengthen national cyber defences, including funding for a National Cyber Shield. For businesses, the broader concern is that fraud is increasingly intersecting with core cyber risk, especially where customer identities, brands and account access are involved.

Almost 70% of phishing threats impersonated brands in high technology, financial services and commerce. High technology accounted for 41.6% of those threats, followed by financial services at 18.9% and commerce at 8.4%.

The study also examined login activity across sectors and regions. High- and critical-risk login activity made up 26.6% of all recorded login attempts, while account verification requests represented 40% of high- and critical-risk login traffic. That suggests attackers are checking whether email addresses are active before launching larger credential-stuffing campaigns.

EMEA trends

In Europe, the Middle East and Africa, malware was the most common threat type, accounting for 44% of observed activity. Advanced persistent threats were next at 16.7%.

The healthcare sector accounted for 6.2% of observed regional attacks in EMEA, with attackers relying mainly on combinations of malware, phishing and ransomware. The report also highlighted a multibrand financial services impersonation campaign in which attackers in the region targeted the automotive and retail sectors.

Commerce recorded the highest overall volume of login attempts globally at 41.1%, making it a frequent target for credential validation, account takeover and loyalty-point abuse. Regionally, Asia-Pacific and Latin America saw the highest proportions of high- and critical-risk login attempts, at 36.4% and 37.8% respectively.

Patrick Sullivan, Chief Technology Officer, Security Strategy, Akamai, said the findings reflected a broader change in how fraud affects organisations.

"The fight against fraud is no longer just an isolated financial function; it is a critical, cross-functional cybersecurity imperative," Sullivan said.

"As autonomous AI agents and synthetic identities redefine how customers interact with brands, threat actors are exploiting these same vectors to conduct business logic abuse and zero-click data exfiltration," he said.

Attack pressure

A shorter phishing lifespan gives security teams less time to detect and block campaigns before attackers move on to fresh infrastructure. Phishing-as-a-service toolkits, bulk domain registration and fast-rotating infrastructure are contributing to that pressure.

The findings also suggest that brand impersonation has become a central route into enterprise risk. When fraudulent domains mimic consumer-facing businesses, attackers can use them not only to steal credentials but also to abuse payment systems, loyalty schemes and other account-based services.

A separate section on ransomware argued that extortion campaigns should be viewed as organised operating models rather than isolated malware incidents. Ofer Wolf, Senior Vice President and General Manager of Enterprise Security, Akamai, described the shift in direct terms.

"Ransomware is no longer just malware; it is a full-fledged criminal operating model centered on extortion. To counter these industrialized operations, CISOs must focus on early disruption: minimizing access via Zero Trust, enforcing microsegmentation to block lateral movement, and hunting for persistent C2 infrastructure before leverage is established," Wolf said.