AI scams overtake phishing as cybercrime turns into an industrialised business. * PublishedNovember 9, 2026 Online scam detections doubled to 6.4 million as attackers exploit brand trust, automate fraud and shrink phishing attack lifespans to just 22 days, Akamai report finds. A consumer searching for an online deal, an employee responding to a familiar workplace notification or a job seeker clicking on a recruitment advertisement may all be entering the same trap. The websites look legitimate, the branding appears familiar and the instructions seem routine. But behind these seemingly ordinary digital interactions is an increasingly sophisticated fraud ecosystem designed to turn trust into financial gain. Cybercrime is undergoing a fundamental shift. Instead of relying predominantly on conventional phishing attacks to steal passwords and credentials, fraudsters are increasingly building multichannel operations that manipulate consumers into making payments, downloading malicious applications and surrendering sensitive personal information. The scale of this transformation is reflected in Akamai's State of the Internet: AI-Driven Digital Deception - The Fraud and Abuse Report 2026. According to the report, online scam detections approximately doubled from 3.2 million to 6.4 million, overtaking traditional phishing for the first time in the first quarter of 2026. Traditional phishing, meanwhile, continued to expand, recording 61% growth by the second quarter. The findings point to a changing cybercrime economy in which attackers are no longer interested only in gaining unauthorised access to accounts. They are increasingly focused on extracting money directly through fake stores, investment scams, technical support fraud, payment deception and impersonation campaigns. From phishing links to an industrialised fraud ecosystem. One of the most significant developments is the growing sophistication of the infrastructure supporting these operations. Akamai's research, conducted in collaboration with Bolster AI, found that attackers are increasingly coordinating campaigns across social media, counterfeit application marketplaces and malicious mobile applications. In one observed attack chain, a paid social media advertisement redirected users to a counterfeit app marketplace, where a malicious application collected sensitive information and exploited device permissions. The industrialisation of these operations is particularly concerning. In one retail campaign, researchers identified more than 1,200 look-alike .shop domains sharing a single IP address and reusing similar HTML, JavaScript and payment-page designs to harvest card numbers, expiry dates and security codes. This points to a criminal infrastructure in which websites, phishing templates and payment collection mechanisms can be replicated at scale rather than built independently for every attack. Artificial intelligence is accelerating the process. Attackers are using AI to generate dynamic templates, create multilingual messages and personalise fraudulent communications, allowing campaigns to reach wider audiences while adapting to security controls. The window available to security teams is also shrinking. The average lifespan of a phishing attack fell from 48 days in the fourth quarter of 2025 to just 22 days in the second quarter of 2026, a decline of more than 50%. This rapid infrastructure rotation makes conventional, reactive security measures increasingly inadequate. By the time an organisation identifies and blocks a malicious domain, attackers may already have shifted operations to another. Asia-Pacific faces a growing account-abuse challenge. The regional findings underline the importance of the threat for Asia-Pacific businesses. In a 30-day sample of login activity analysed by Akamai, the region accounted for 25.1% of recorded login attempts. More significantly, 36.4% of login attempts in APAC were classified as high or critical risk, compared with 23.6% in North America and 23.7% in Europe, the Middle East and Africa. The report also found that account verification requests represented 40% of high- and critical-risk login activity. Such requests may indicate that attackers are checking whether email addresses correspond to legitimate accounts before launching credential-stuffing campaigns. A case involving a large financial institution in APAC illustrates how these attacks can operate at different scales. During the week beginning July 29, 2026, researchers observed approximately 42,000 requests from a botnet attempting to validate personally identifiable information. At the same time, a separate low-volume campaign generated 164 requests, potentially to establish accounts for money-mule activity or synthetic identity fraud. The contrast is important. While large-scale attacks can generate obvious warning signals, smaller campaigns may deliberately remain below detection thresholds. Brand trust becomes the new attack surface. The report identifies brand impersonation as another major component of the evolving threat landscape. Between January and July 2026, high-technology brands accounted for 41.6% of malicious domains impersonating enterprise brands, followed by financial services at 18.9% and commerce at 8.4%. Attackers are exploiting familiar logos, cloned login pages, fake customer-service portals and spoofed payment interfaces to make fraudulent interactions appear legitimate. The consequences extend beyond stolen credentials. A compromised retail account can be used to make unauthorised purchases, drain loyalty points or redirect refunds. In financial services, attackers can change contact information, add beneficiaries and divert payments into money-mule accounts. Even major sporting events have become opportunities for organised fraud. Akamai researchers identified a coordinated ticket-impersonation campaign involving 12 unique hostnames and 20 captured website instances. The cloned portals directed users through fake purchase journeys designed to collect payment-card details, personal information and, in some cases, passport or identity-document details. The stolen information can subsequently support identity fraud, account takeovers and further financial scams. The next challenge: Securing an AI-driven internet. The emergence of autonomous AI agents introduces another layer of complexity. As consumers increasingly interact with businesses through AI platforms, rather than visiting websites directly, organisations must account for automated agents that can search, transact and access services on behalf of users. Akamai warns that this evolving agentic web creates new vulnerabilities involving synthetic identities, application programming interfaces and Model Context Protocol endpoints. The report argues that cybersecurity can no longer remain confined to conventional network protection. Organisations need to bring cybersecurity, fraud prevention, finance, marketing, customer experience and compliance teams together to identify threats across the entire customer journey. Its recommendations include behavioural bot detection, stronger API protection, automated investigations, monitoring of shared phishing infrastructure, controls against fake account creation and improved governance of AI-agent identities. The larger message is that digital trust has become an economic asset, and increasingly, a target. As cybercriminals industrialise deception and AI accelerates their operations, protecting businesses will require more than blocking malicious links or strengthening passwords. It will require identifying fraudulent intent before a seemingly legitimate digital interaction turns into a financial loss. Disclaimer: The views expressed in this article are those of the author/authors and do not necessarily reflect the views of ET Edge Insights, its management, or its members.

Bolster AI launches Threat Graph to expose connected cyberattack campaigns. October, 2026 Bolster AI has launched Threat Graph, a new capability within Bolster AI Signals designed to help security teams uncover the broader infrastructure behind phishing, impersonation and online fraud campaigns. Rather than investigating threats one at a time, Threat Graph connects related malicious domains, websites and supporting infrastructure in an interactive visual graph, helping analysts identify relationships and expand investigations beyond the initial alert. The capability is designed to give security teams greater context as attackers increasingly use AI and automation to scale fraudulent activity across websites, social media, digital advertising and other channels. By combining connected threat intelligence with Bolster AI's discovery and automated takedown capabilities, organizations can identify more of the infrastructure supporting an attack, prioritize response and disrupt larger campaigns rather than addressing individual threats in isolation.