A new report from Akamai has found that online scams surpassed traditional phishing attacks for the first time in 2026, nearly doubling from about 3.2 million to approximately 6.4 million year-over-year. The researchers say this signals a “shift toward higher-return fraud tactics focused on direct financial and consumer deception.”
“Since MFA has become a baseline security measure, attackers are pivoting toward higher-return scams for faster payouts,” the researchers write. “Traditional phishing, however, still grew by 61% by Q2 2026, according to Bolster. Together, these numbers show that while credential theft remains a core driver, threat actors are aggressively expanding into social engineering tactics that can manipulate consumers into direct financial losses.” Threat actors are increasingly using AI to streamline these attacks, allowing them to launch higher volumes of attacks for less effort.
“Attackers are expanding their use of AI to create more varied phishing templates, produce multilingual content at scale, and deploy adaptive evasion techniques,” the report says. “These capabilities reduce the cost and effort required to build convincing scams and make campaigns faster to launch, scale, and modify.”
Attackers are also using AI as a phishing lure, impersonating popular AI services with malicious websites. “Beyond traditional phishing attacks, adversaries are capitalizing on the boom of generative AI in the workplace,” Akamai says. “This has given rise to ‘AI phishing,’ which is defined as attacks that include fake sites impersonating major platforms like OpenAI’s ChatGPT to pilfer employee credentials. Although AI phishing currently represents only 3.3% of observed activity, organizations should monitor it closely as a critical initial access vector. According to our Enterprise AI Usage Risk Report 2026, nearly half of enterprise employees have tried workplace AI tools, though only 18% use them weekly; those figures will likely rise steadily over time. As employee adoption inevitably scales, these low-volume lures will likely transform into high-yield entry points for enterprise compromise.”
Akamai has the story: https://www.akamai.com/lp/state-of-the-internet/digital-fraud-abuse-report-2026
