Attackers are expanding their use of AI to create more varied phishing templates, produce multilingual content at scale, and deploy adaptive evasion techniques. These capabilities reduce the cost and effort required to build convincing scams and make campaigns faster to launch, scale, and modify.
Key Takeaways
-
AI continues to increase the speed and scale of fraud and abuse.
-
Attackers are using AI to create more varied phishing content, localize campaigns, and adapt infrastructure faster, making scams easier to scale and harder for traditional defenses to disrupt.
-
Online scams are overtaking traditional phishing.
-
Scam detections nearly doubled and surpassed phishing for the first time in Q1 2026, signaling a shift toward higher-return fraud tactics focused on direct financial and consumer deception.
-
Shrinking phishing lifespans are compressing response windows.
-
The average phishing attack lifespan fell by more than 50%, from 48.3 days in Q4 2025 to 22 days in Q2 2026, giving defenders less time to detect and disrupt campaigns before attackers rotate infrastructure.
-
Fraud and abuse span the entire account lifecycle.
-
Risks emerge from account creation and verification through login, password changes, payments, and stored-value abuse, with high-risk activity especially concentrated around login and account verification.
-
Defenders need more dynamic, intent-focused controls.
-
The report recommends combining behavioral inspection, stronger bot and account protections, cross-platform threat intelligence, and automated investigation workflows to respond more quickly to fast-changing fraud and abuse campaigns.
Frequently Asked Questions (FAQ)
Frequently Asked Questions (FAQ)
Online scam detections nearly doubled from ~3.2 million to ~6.4 million and surpassed traditional phishing in Q1 2026. The report notes that attackers are increasingly shifting toward higher-return scams focused on direct financial or consumer deception, even as phishing continues to grow.
The average phishing attack lifespan dropped from 48.3 days in Q4 2025 to 22 days in Q2 2026. Faster infrastructure rotation gives security teams less time to identify and disrupt campaigns before attackers move to new domains and infrastructure.
Login is the most active stage of the account lifecycle and a major entry point for malicious bot activity. Account verification requests made up 40% of high- and critical-risk login traffic, suggesting that attackers may be validating legitimate accounts before launching credential stuffing or other abuse.
The report recommends moving beyond static perimeter controls and reactive blocklists toward intent-based behavioral inspection, automated investigation and takedown workflows, stronger bot and account protections, and the tracking of durable back-end signals that persist even as attackers rotate domains.