Akamai Report: AI-Driven Digital Deception Is Escalating Enterprise Fraud and Shrinking Phishing Lifespans

Account verification requests represented 40% of high- and critical-risk login traffic in Akamai’s research.

Rhea-AI Summary

Akamai (AKAM) released a cybersecurity research report finding that online scams surpassed traditional phishing for the first time in Q1 2026. Scam detections approximately doubled from ~3.2 million to ~6.4 million. Average phishing attack lifespan fell from 48 days in Q4 2025 to 22 days in Q2 2026.

High- and critical-risk activity represented 26.6% of recorded login attempts. Nearly 70% of phishing threats impersonated high technology, financial services and commerce brands. Akamai recommends behavioral inspection throughout the account lifecycle and microsegmentation, which separates network systems to restrict movement between them.

Key Figures

Online scam detections: ~3.2 million to ~6.4 million Phishing attack lifespan: 48 days to 22 days Phishing threats impersonating brands: Nearly 70% (high tech 41.6%; financial services 18.9%; commerce 8.4%) +4 more

Online scam detections

~3.2 million to ~6.4 million

Q1 2026

Phishing attack lifespan

48 days to 22 days

Q4 2025 to Q2 2026

Phishing threats impersonating brands

Nearly 70% (high tech 41.6%; financial services 18.9%; commerce 8.4%)

Report findings

High- and critical-risk login activity

26.6%

Share of all recorded login attempts

Account verification requests

40%

Share of high/critical login traffic

Commerce login attempts

41.1%

Share of total login attempts

High- and critical-risk login attempts by region

APAC 36.4%; LATAM 37.8%

Regional proportions

Key Terms

phishing as a service, credential stuffing, microsegmentation, zero trust

4 terms

phishing as a service technical

"phishing as a service (PhaaS) toolkits"

A criminal marketplace service that sells or rents ready-made tools, hosting and support so customers can run phishing attacks without building technical infrastructure themselves. Typical offerings include cloned website templates, email-sending infrastructure, automated credential-capture pages, tracking dashboards, and options for pay-as-you-go, subscriptions or affiliate payouts; operators may also supply anonymizing hosting or stolen mailing lists. The model lowers the technical barrier and speeds up large-scale abuse, and it is distinct from legitimate, consent-based phishing simulations run by organizations for security training because phishing-as-a-service is used to commit fraud, theft or network intrusion.

credential stuffing technical

"prior to launching large-scale credential stuffing attacks"

Attackers take lists of stolen usernames and passwords from one breach and try them on many other accounts, hoping users reused the same credentials—like trying the same key in dozens of locks. For investors, successful credential stuffing can lead to customer account takeovers, financial losses, regulatory fines, reputational damage and higher security costs, all of which can hurt revenue and share value.

microsegmentation technical

"enforcing microsegmentation to block lateral movement"

Microsegmentation is the practice of dividing a larger group—such as customers, network devices, or data access—into many very small, specific segments based on behavior, risk, or needs. For investors, it matters because it can improve security and efficiency (like locking individual rooms instead of just the front door) and enable more precise marketing or cost control, potentially reducing losses and raising revenue per customer.

zero trust technical

"minimizing access via Zero Trust"

Zero trust is a security approach that assumes no one, whether inside or outside an organization, should be automatically trusted. Instead, every access request is carefully verified before being granted, much like checking ID at every door rather than trusting someone just because they are known. For investors, it emphasizes the importance of protecting digital assets and data from potential breaches, reducing overall risk.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

Key takeaways

• Online scams approximately doubled in volume, surpassing traditional phishing for the first time in Q1 2026.
• The majority of malicious domains that targeted enterprise networks during the reporting period impersonated high tech, financial services, and commerce brands.
• The phishing attack lifespan declined from 48 days (Q4 2025) to 22 days (Q2 2026).
  
  

CAMBRIDGE, Mass., Oct. 29, 2026 (GLOBE NEWSWIRE) -- Highlighting the increasing security risks posed by AI, Akamai (Nasdaq: AKAM) today released its latest State of the Internet (SOTI) report: AI-Driven Digital Deception: The Fraud and Abuse Report 2026. The report reveals a dramatic evolution in the digital threat landscape, where threat actors are leveraging AI and automated infrastructure to bypass traditional security perimeters, exploit the entire account lifecycle, and abuse corporate brand trust.

According to the research, online scams — ranging from fake retail domains and social recruitment traps to spoofed event portals — surpassed traditional phishing for the first time in Q1 2026, with detections approximately doubling from ~3.2 million to ~6.4 million. Concurrently, the operational lifespan of phishing attacks dropped by more than 50% (from 48 days in Q4 2025 to just 22 days in Q2 2026), forcing enterprise defenders into a race against fast-rotating attacker infrastructure.

“The fight against fraud is no longer just an isolated financial function; it is a critical, cross-functional cybersecurity imperative,” said Patrick Sullivan, Chief Technology Officer, Security Strategy at Akamai. “As autonomous AI agents and synthetic identities redefine how customers interact with brands, threat actors are exploiting these same vectors to conduct business logic abuse and zero-click data exfiltration.”

Key findings from the SOTI report

• Scams overtake phishing: Driven by higher financial returns, online scams approximately doubled, eclipsing traditional credential-harvesting phishing. Nearly 70% of phishing threats impersonated high technology (41.6%), financial services (18.9%), and commerce (8.4%) brands.
• Shrinking attack windows: The average phishing attack lifespan plummeted by more than 50% (to 22 days) from Q4 2025 to Q2 2026. Attackers are increasingly leveraging phishing as a service (PhaaS) toolkits, bulk domain registration, and fast-rotating infrastructure to evade static blocklists.
• Account lifecycle abuse: High- and critical-risk login activity accounted for 26.6% of all recorded login attempts. Notably, account verification requests made up 40% of high/critical login traffic, indicating adversaries systematically validate email addresses prior to launching large-scale credential stuffing attacks.
• Industry and regional focus: Commerce experienced the highest volume of total login attempts (41.1%), making it an attractive target for credential validation, account takeover, and loyalty-point abuse. Regionally, Asia-Pacific (APAC) and Latin America (LATAM) recorded the highest proportions of high- and critical-risk login attempts at 36.4% and 37.8%, respectively.
  
  

The report features a security spotlight on ransomware by Ofer Wolf, Senior Vice President and General Manager of Enterprise Security, Akamai. He explains, “Ransomware is no longer just malware; it is a full-fledged criminal operating model centered on extortion. To counter these industrialized operations, CISOs must focus on early disruption: minimizing access via Zero Trust, enforcing microsegmentation to block lateral movement, and hunting for persistent C2 infrastructure before leverage is established.”

Recommended mitigation strategies

To defend against AI-driven digital deception, Akamai recommends that security leaders evolve their bot defenses. The report offers strategies such as implementing intent-based behavioral inspection across every stage of the account lifecycle to block low-and-slow credential stuffing and credit card testing. It also recommends deploying microsegmentation as part of an overall ransomware mitigation strategy.

Now in their 12th year, Akamai’s SOTI reports continue to offer critical insights on cybersecurity trends and web performance, drawn from attacks viewed across Akamai’s cybersecurity infrastructure, which handles a significant portion of global web traffic.

About Akamai
Akamai is the cloud company that powers and protects an AI-driven world. Our cloud platform extends high-performance cloud computing from the core to the edge, enabling organizations to build and scale next-generation AI applications and providing comprehensive, multilayered security to safeguard enterprises against evolving cyberthreats. Learn more at akamai.com and akamai.com/blog, or follow Akamai Technologies on X and LinkedIn.

Contacts
Akamai Media Relationsakamaipr@akamai.com

Akamai Investor Relations
invrel@akamai.com

FAQ

AI-generated questions and answers. How Rhea-AI works. Not financial advice.

What did Akamai’s 2026 fraud report find about scams and phishing?

Online scams surpassed traditional phishing for the first time in Q1 2026, with detections approximately doubling from ~3.2 million to ~6.4 million. Average phishing attack lifespan declined from 48 days in Q4 2025 to 22 days in Q2 2026.

Which regions had the highest proportions of risky logins in Akamai’s 2026 fraud report?

Latin America and Asia-Pacific recorded the highest proportions of high- and critical-risk login attempts, at 37.8% and 36.4%, respectively.