Attackers Aren’t Hacking Your Customers. They’re Impersonating You.

It’s not new to say fraud and abuse are threatening online businesses — those types of attacks are often accepted as the price of doing business in many industries. But the tactics are continuing to change and agentic AI is making deception more adaptive and persistent, which is giving attackers new ways to exploit customer trust in familiar brands. 

The abuse can take many forms: misused logos and brand impersonation; look-alike domains and spoofed portals; and scams that move across email, paid advertisements, social media, and other channels. 

Attackers continue to find innovative ways to target brands and customers. The evolution of these increasingly sophisticated attacker tactics that we’ve observed in the fraud and abuse ecosystem is unprecedented. 

Generative AI (GenAI) can help attackers tailor phishing messages and produce them at scale. Attackers are also exploiting interest in AI tools themselves: AI phishing ranked seventh in our dataset and includes fake sites that impersonate platforms such as OpenAI’s ChatGPT to harvest employee credentials. 

Phishing as a service (PhaaS) further lowers the effort needed to launch and scale impersonation campaigns. The EvilProxy toolkit, which ranked third among the phishing threats in our dataset, accounted for almost 10% of attacks. It is a PhaaS platform that uses an adversary-in-the-middle approach to capture credentials and active session cookies during sign-in. The user can do everything right, even complete the multi-factor authentication prompt, and the attacker can still walk off with the session data.

As phishing kits scale and attackers rotate their infrastructure, defenders have less time to identify and disrupt campaigns. Blocking the reported domain feels productive, but it only addresses a moving target. Security teams must monitor for suspicious sign-ins and session activity that could indicate a compromised account.

The threat from fake sites remains immediate. One campaign tied to a high-profile international sporting event shows how impersonation can work at scale. Our researchers identified dozens of spoofed ticketing and hospitality sites that shared back-end infrastructure and used near-identical checkout flows. Prominent “BUY NOW” prompts led visitors toward forms designed to collect payment card details, personal information, and identity documents.

A separate case shows how attackers also impersonate familiar commerce brands. Our researchers identified two Amazon-themed phishing domains that generated 640 DNS connection attempts across 181 customers.

These examples show how attackers can use familiar brands and purchase experiences to draw people to sites outside an organization’s control. Protecting customers means looking beyond the login page to look-alike domains and fraudulent purchase flows while also accounting for the separate risks introduced by automated interactions.

Multichannel campaigns often begin with paid social ads or fraudulent recruitment posts that lure users. These posts may direct users to counterfeit app stores or malicious websites, where they are prompted to download harmful applications or submit sensitive credentials. 

Because these campaigns span multiple platforms and services, controls focused on any one platform may miss parts of the attack. A social media profile, for example, may direct users to an encrypted messaging app or a page that collects links to other sites. While the supporting infrastructure may be distributed globally, attackers tailor campaign content to local audiences, including their language, industry, and preferred payment methods.

Fraud threats span every phase of the customer journey, from account creation and login to identity verification and payment processing. Attackers use automated credential stuffing and bot networks at each stage to identify active accounts and gain unauthorized access.

A 30-day sample of data from Akamai Account Protector showed that 26.6% of login attempts were at the high or critical risk level (Figure 2). Those levels indicate a likelihood of brute-force attacks and credential stuffing.

Organizations should monitor login activity closely because it can provide an early warning of account abuse. Also, the login phase is the most active stage of the account lifecycle and a common entry point for malicious bots. Standard login attempts represented the largest share of activity across all risk levels, followed by account verification requests (Figure 3).

Notably, account verification requests made up 40% of high- and critical-risk login traffic, which may indicate attempts to determine whether email addresses are associated with existing accounts.

Your organization can't stop every attacker, but you can make sure that your customers never wonder whether the login page, the checkout, or the text message was really created by you.