Akamai’s (Nasdaq: AKAM) State of the Internet (SOTI) report indicates that in the first quarter of 2026, the volume of online scams nearly doubled, surpassing that of traditional phishing attacks for the first time. Titled ‘AI-Driven Digital Deception: The Fraud and Abuse Report 2026’, this study describes malicious actors exploiting artificial intelligence (AI) and automated infrastructures to bypass classic security perimeters.
According to the report, these scams range from fake sales sites and recruitment traps on social networks to fraudulent event portals. The number of detections rose from approximately 3.2 million to around 6.4 million. At the same time, the operational lifespan of phishing attacks fell by more than 50%, from 48 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026. Nearly 70% of phishing attacks mimicked brands in the technology (41.6%), financial services (18.9%), and retail (8.4%) sectors.
A Persistent Threat in Europe
In the EMEA region, nearly one in four login attempts was reported as high-risk. The report links this finding to a persistent threat related to brute force attacks, credential stuffing, i.e., the mass testing of stolen credentials across multiple sites, and account takeover.
Malware and advanced persistent threats (APT) account for over 60% of attack traffic in the region. Malware alone makes up 44% of the total volume, ahead of APTs (16.7%), Trojans (13%), ransomware (9.8%), phishing (6.1%), and botnets (5.2%). During a brand impersonation campaign targeting multiple financial services brands, malicious actors concentrated their attempts on the automotive and retail sectors.
Accounts Under Pressure Globally
Globally, high-risk or critical-risk login attempts accounted for 26.6% of all recorded attempts. Account verification requests alone constituted 40% of this traffic. According to the report, this indicates that attackers systematically validate email addresses before launching large-scale credential stuffing attacks.
Retail is the sector that recorded the highest number of login attempts, at 41.1%, making it, according to the study, a prime target for credential validation, account hacking, and fraudulent use of loyalty points. Asia-Pacific (APAC) and Latin America (LATAM) show the highest proportions of high-risk or critical-risk attempts, at 36.4% and 37.8% respectively.
Patrick Sullivan, Chief Technology Officer, Security Strategy at Akamai, believes that ‘fighting fraud is no longer just an isolated financial function but a cross-cutting cybersecurity imperative.’ He adds: ‘Autonomous AI agents and synthetic identities are transforming how customers interact with brands. At the same time, malicious actors are exploiting these same vectors to commit business logic abuse and non-interactive data exfiltration.’
The report also includes an analysis of ransomware, authored by Ofer Wolf, Senior Vice President and General Manager of Enterprise Security at Akamai. He states: ‘Ransomware is no longer just malware: it has now become a full-fledged criminal operational model focused on extortion.’ For Chief Information Security Officers (CISOs), the study recommends strengthening bot defenses, implementing behavioral inspection at every stage of an account’s lifecycle, and micro-segmentation to limit lateral movement within networks. The full report is available on Akamai’s website.
