Key takeaways

• Online scams approximately doubled in volume, surpassing traditional phishing for the first time in Q1 2026.
• The majority of malicious domains that targeted enterprise networks during the reporting period impersonated high tech, financial services, and commerce brands.
• The phishing attack lifespan declined from 48 days (Q4 2025) to 22 days (Q2 2026).
  
  

CAMBRIDGE, Mass., Oct. 29, 2026 (GLOBE NEWSWIRE) -- Highlighting the increasing security risks posed by AI, Akamai (Nasdaq: AKAM) today released its latest State of the Internet (SOTI) report: AI-Driven Digital Deception: The Fraud and Abuse Report 2026. The report reveals a dramatic evolution in the digital threat landscape, where threat actors are leveraging AI and automated infrastructure to bypass traditional security perimeters, exploit the entire account lifecycle, and abuse corporate brand trust.

According to the research, online scams — ranging from fake retail domains and social recruitment traps to spoofed event portals — surpassed traditional phishing for the first time in Q1 2026, with detections approximately doubling from ~3.2 million to ~6.4 million. Concurrently, the operational lifespan of phishing attacks dropped by more than 50% (from 48 days in Q4 2025 to just 22 days in Q2 2026), forcing enterprise defenders into a race against fast-rotating attacker infrastructure.

“The fight against fraud is no longer just an isolated financial function; it is a critical, cross-functional cybersecurity imperative,” said Patrick Sullivan, Chief Technology Officer, Security Strategy at Akamai. “As autonomous AI agents and synthetic identities redefine how customers interact with brands, threat actors are exploiting these same vectors to conduct business logic abuse and zero-click data exfiltration.”

Key findings from the SOTI report

• Scams overtake phishing: Driven by higher financial returns, online scams approximately doubled, eclipsing traditional credential-harvesting phishing. Nearly 70% of phishing threats impersonated high technology (41.6%), financial services (18.9%), and commerce (8.4%) brands.
• Shrinking attack windows: The average phishing attack lifespan plummeted by more than 50% (to 22 days) from Q4 2025 to Q2 2026. Attackers are increasingly leveraging phishing as a service (PhaaS) toolkits, bulk domain registration, and fast-rotating infrastructure to evade static blocklists.
• Account lifecycle abuse: High- and critical-risk login activity accounted for 26.6% of all recorded login attempts. Notably, account verification requests made up 40% of high/critical login traffic, indicating adversaries systematically validate email addresses prior to launching large-scale credential stuffing attacks.
• Industry and regional focus: Commerce experienced the highest volume of total login attempts (41.1%), making it an attractive target for credential validation, account takeover, and loyalty-point abuse. Regionally, Asia-Pacific (APAC) and Latin America (LATAM) recorded the highest proportions of high- and critical-risk login attempts at 36.4% and 37.8%, respectively.
  
  

The report features a security spotlight on ransomware by Ofer Wolf, Senior Vice President and General Manager of Enterprise Security, Akamai. He explains, “Ransomware is no longer just malware; it is a full-fledged criminal operating model centered on extortion. To counter these industrialized operations, CISOs must focus on early disruption: minimizing access via Zero Trust, enforcing microsegmentation to block lateral movement, and hunting for persistent C2 infrastructure before leverage is established.”

Recommended mitigation strategies

To defend against AI-driven digital deception, Akamai recommends that security leaders evolve their bot defenses. The report offers strategies such as implementing intent-based behavioral inspection across every stage of the account lifecycle to block low-and-slow credential stuffing and credit card testing. It also recommends deploying microsegmentation as part of an overall ransomware mitigation strategy.

Now in their 12th year, Akamai’s SOTI reports continue to offer critical insights on cybersecurity trends and web performance, drawn from attacks viewed across Akamai’s cybersecurity infrastructure, which handles a significant portion of global web traffic.

About Akamai
Akamai is the cloud company that powers and protects an AI-driven world. Our cloud platform extends high-performance cloud computing from the core to the edge, enabling organizations to build and scale next-generation AI applications and providing comprehensive, multilayered security to safeguard enterprises against evolving cyberthreats. Learn more at akamai.com and akamai.com/blog, or follow Akamai Technologies on X and LinkedIn.

Contacts
Akamai Media Relationsakamaipr@akamai.com

Akamai Investor Relations
invrel@akamai.com