Akamai’s new State of the Internet report, AI-Driven Digital Deception: The Fraud and Abuse Report 2026, paints a clear picture: fraud is no longer a side problem for security teams. Instead, it has become an industrialized business that attacks a company’s most valuable asset, its brand trust.
Scams Take the Lead
Using data from Bolster AI, the report finds that online scam detections roughly doubled, from about 3.2 million to 6.4 million. By early 2026, scams had surpassed traditional phishing for the first time. Scams aim at direct financial loss through fake stores, investment schemes, and fake job offers, rather than stealing passwords. Akamai’s reasoning is simple: with multi-factor authentication now standard, attackers are choosing faster, higher-return paths. Phishing still grew by 61%, so both threats are rising.
Shrinking Response Windows
The average life of a phishing attack fell from 48 days in late 2025 to 22 days by mid-2026. As a result, attackers register look-alike domains in bulk, rotate infrastructure within hours, and hide malicious pages from automated crawlers. Akamai advises defenders to track durable back-end signals, such as certificates and shared servers, rather than chasing individual domains. A fake sporting-event ticket campaign showed why: 12 spoofed sites all routed payments to a shared back end.
The Login Page Is the Front Line
In a 30-day sample, 26.6% of login attempts were high- or critical-risk. Among those risky attempts, account verification requests accounted for 40%, suggesting criminals check whether email addresses are real before launching credential-stuffing attacks. Commerce had the riskiest logins (41.1%), followed by financial services (20.8%). Asia-Pacific and Latin America had the highest shares of risky attempts, at 36.4% and 37.8%, respectively. The FBI’s 2025 report, cited by Akamai, puts US account takeover losses at $359.7 million.
Brands as Bait
Most malicious domains targeting enterprises impersonated high-tech (41.6%), financial services (18.9%), and commerce (8.4%) brands. The report also flags “AI phishing,” in which fake sites pose as tools like ChatGPT to steal employee credentials. Although it is only 3.3% of activity today, Akamai expects it to grow as workplace AI adoption rises.
Ransomware Is About Extortion
Akamai argues that ransomware is now an operating model, not just a type of malware. Some gangs skip encryption entirely and rely on stolen data as leverage. Accordingly, the FBI recorded a 14.4% rise in ransomware complaints and a 159% jump in losses. The advice: treat ransomware as an outcome of a longer intrusion, and treat persistent command-and-control traffic as an emergency even without visible damage. Akamai says companies using microsegmentation contained attacks 21.4% faster.
The Agentic AI Challenge
The report devotes considerable time to AI agents acting on behalf of customers. As “zero-click” interactions grow, firms must distinguish malicious bots from authorized agents, even as legal rules remain unsettled. Akamai’s privacy chief points to open questions on liability, consent and data minimization, and to proposals such as Senator Warner’s AI AGENT Act.
What Leaders Should Do
Akamai recommends:
- Intent-based bot detection across the whole account lifecycle
- Rate limits on one-time-password triggers, to stop SMS pumping
- Protection for APIs and emerging AI endpoints
- Closer teamwork among security, fraud and marketing teams through “fusion centers”
- Governance that treats AI agents as a distinct identity class
The Takeaway
The report’s central message is that digital trust is no longer an asset to guard but a capability to earn continuously. Readers should remember that it comes from a security vendor, so its solutions tend to favor Akamai’s own product areas. Even so, its data points in the same direction: faster, cheaper, AI-assisted deception that rewards companies able to move faster than their attackers.
