Threat reportPhishingTL-2026-4991
Online Scam Volumes Double to Overtake Phishing (Akamai/Bolster AI data; AI-driven phishing kits and shorter attack lifespans)
Online Scam Volumes Double to Overtake Phishing (TL-2026-4991), also tracked as Akamai State of the Internet Fraud and Abuse Report 2026, is a medium-severity phishing campaign, first published 2026-11-01. It has no confirmed attribution, affects Various Consumers and organizations targeted by online scams and, maps to 5 MITRE ATT&CK techniques (T1480, T1566, T1588.007), and is covered by 9 detection rules and 3 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 3Indicators of compromise
Key facts for TL-2026-4991
- Threat ID
- TL-2026-4991
- Also known as
- Akamai State of the Internet Fraud and Abuse Report 2026
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, finance, consumer, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 3
How Online Scam Volumes Double to Overtake Phishing works
Akamai's State of the Internet report, using Bolster AI data, shows online scam detections doubled from 3.2M (Jul-Sep 2025) to 6.4M (Apr-Jun 2026), overtaking phishing. Phishing detections rose 61% while average phishing attack lifespan fell from 48 days (Q4 2025) to 22 days (Q2 2026), driven by reusable phishing kits, AI-generated dynamic templates, multilingual lures and condition-aware evasion.
This is a trend-level intelligence item, not a single exploited vulnerability. Akamai's State of the Internet (Fraud and Abuse) report, drawing on Bolster AI detection data and covered by Infosecurity Magazine on 2026-10-29, reports that online scam detections doubled between July 2025 and June 2026: 3.2 million in July-September 2025 versus 6.4 million in April-June 2026. Scams now outnumber phishing detections. The scam categories named in the coverage are fake stores, investment scams, tech support scams and payment fraud.
Phishing is also growing: detections rose 61% over the period, but the average lifespan of a phishing attack fell from 48 days in Q4 2025 to 22 days in Q2 2026, a drop of more than half. The report attributes this to adversaries using AI to generate dynamic templates, produce multilingual lures at scale and deploy condition-aware evasion, combined with reusable phishing kits. Shorter lifespans mean takedown-based and blocklist-based defenses have a smaller window to act, and detection must rely more on behavioral and brand-impersonation signals than on static indicators.
The coverage also cites an Identity Theft Resource Center (ITRC) report published 2026-10-28 on scam victim impact: over 80% of surveyed victims reported suicidal thoughts, 89% received no response from organizations they contacted, 67.2% felt blamed, and 78.9% of general scam victims paid recovery-scam fees (90.9% among those with suicidal ideation). Recovery scams therefore act as a secondary victimization stage.
No CVE, CVSS score, named threat actor, malware family, or network IOC (IP/domain/hash) is stated in the sources. The full Akamai report sits behind a download form and could not be read in full; this record is limited to what the press coverage and public landing pages evidence. A BeaconBeagle check was not applicable because there are no network IOCs. IOC entries below are behavioral/technique indicators and source entities, not adversary infrastructure.
MITRE ATT&CK techniques used in TL-2026-4991
Defense Evasion
T1480 Execution Guardrails; T1684.001 Impersonation
Initial Access
Resource Development
T1588.007 Obtain Capabilities: Artificial Intelligence
Impact
Affected products and versions in Online Scam Volumes Double to Overtake Phishing
- Various — Consumers and organizations targeted by online scams and phishing (fake stores, investment, tech support, payment fraud)
Remediation for Online Scam Volumes Double to Overtake Phishing
Immediate actions
- Report and request takedown of impersonating domains and fake stores quickly, since average phishing lifespan is now about 22 days
- Alert customers and staff to fake-store, investment, tech-support and payment-fraud lures, including multilingual variants
- Warn victims that recovery-scam offers are a follow-on fraud
Workarounds
- Enforce phishing-resistant MFA (FIDO2/passkeys) to limit credential-harvesting impact
- Use secure web gateway or DNS filtering with fast-updating threat feeds
Longer-term hardening
- Deploy brand-protection and newly-registered-domain monitoring for brand impersonation
- Use behavioral and content-agnostic phishing detection rather than static template or string matching
- Run phishing-awareness training that covers AI-generated, localized lures
- Provide victim-support and escalation paths so scam reports receive a response
Timeline of Online Scam Volumes Double to Overtake Phishing
- Start of the Jul-Sep 2025 quarter in which 3.2 million online scams were detected (baseline for the doubling)
- Q4 2025: average phishing attack lifespan measured at 48 days
- Apr-Jun 2026: scam detections reach 6.4 million, double the Jul-Sep 2025 level and above phishing detections
- End of Q2 2026: average phishing lifespan down to 22 days; phishing detections up 61% over the period
- ITRC publishes report on scam victim impact and recovery-scam losses
- Infosecurity Magazine reports Akamai/Bolster AI findings that scams have overtaken phishing
Sources cited for Online Scam Volumes Double to Overtake Phishing
- Online Scam Volumes Double to Overtake Phishing - Infosecurity Magazine
- Akamai State of the Internet: Digital Fraud and Abuse Report 2026
- Akamai - The State of the Internet
- Bolster AI - 2026 Fraud Trends Report
- Bolster AI - 2026 Fraud Trends and Phishing Predictions Report
- ITRC - 2026 Trends in Identity Report: Hacked Devices Overtake Scams
- Bitdefender 2026 Global Scam Intelligence Report - online scams as a cross-platform cybercrime industry
Detection coverage for TL-2026-4991
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4991 across Splunk SPL, Microsoft KQL and Sigma, covering 3 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.