# Online Scam Volumes Double to Overtake Phishing (Akamai/Bolster AI data; AI-driven phishing kits and shorter attack lifespans)

> Akamai's State of the Internet report, using Bolster AI data, shows online scam detections doubled from 3.2M (Jul-Sep 2025) to 6.4M (Apr-Jun 2026), overtaking phishing. Phishing detections rose 61% while average phishing attack lifespan fell from 48 days (Q4 2025) to 22 days (Q2 2026), driven by reusable phishing kits, AI-generated dynamic templates, multilingual lures and condition-aware evasion.

- **Published:** 2026-11-01T11:04:33Z
- **Last reviewed:** 2026-11-01T11:04:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4991
- **ID:** TL-2026-4991
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 3 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a trend-level intelligence item, not a single exploited vulnerability. Akamai's State of the Internet (Fraud and Abuse) report, drawing on Bolster AI detection data and covered by Infosecurity Magazine on 2026-10-29, reports that online scam detections doubled between July 2025 and June 2026: 3.2 million in July-September 2025 versus 6.4 million in April-June 2026. Scams now outnumber phishing detections. The scam categories named in the coverage are fake stores, investment scams, tech support scams and payment fraud.

Phishing is also growing: detections rose 61% over the period, but the average lifespan of a phishing attack fell from 48 days in Q4 2025 to 22 days in Q2 2026, a drop of more than half. The report attributes this to adversaries using AI to generate dynamic templates, produce multilingual lures at scale and deploy condition-aware evasion, combined with reusable phishing kits. Shorter lifespans mean takedown-based and blocklist-based defenses have a smaller window to act, and detection must rely more on behavioral and brand-impersonation signals than on static indicators.

The coverage also cites an Identity Theft Resource Center (ITRC) report published 2026-10-28 on scam victim impact: over 80% of surveyed victims reported suicidal thoughts, 89% received no response from organizations they contacted, 67.2% felt blamed, and 78.9% of general scam victims paid recovery-scam fees (90.9% among those with suicidal ideation). Recovery scams therefore act as a secondary victimization stage.

No CVE, CVSS score, named threat actor, malware family, or network IOC (IP/domain/hash) is stated in the sources. The full Akamai report sits behind a download form and could not be read in full; this record is limited to what the press coverage and public landing pages evidence. A BeaconBeagle check was not applicable because there are no network IOCs. IOC entries below are behavioral/technique indicators and source entities, not adversary infrastructure.

## MITRE ATT&CK

- T1566 Phishing
- T1684.001 Impersonation
- T1480 Execution Guardrails
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1657 Financial Theft

## Sources

- [Online Scam Volumes Double to Overtake Phishing - Infosecurity Magazine](https://www.infosecurity-magazine.com/news/online-scam-volumes-double/)
- [Akamai State of the Internet: Digital Fraud and Abuse Report 2026](https://www.akamai.com/lp/state-of-the-internet/digital-fraud-abuse-report-2026)
- [Akamai - The State of the Internet](https://www.akamai.com/our-thinking/the-state-of-the-internet)
- [Bolster AI - 2026 Fraud Trends Report](https://bolster.ai/webinars/2026-fraud-trends-report)
- [Bolster AI - 2026 Fraud Trends and Phishing Predictions Report](https://mill-all.com/digital-diary/2026-fraud-trends-and-phishing-predictions-report-with-bolster-ai/)
- [ITRC - 2026 Trends in Identity Report: Hacked Devices Overtake Scams](https://www.idtheftcenter.org/post/2026-trends-in-identity-report-hacked-devices-overtake-scams/)
- [Bitdefender 2026 Global Scam Intelligence Report - online scams as a cross-platform cybercrime industry](https://www.unite.ai/bitdefender-2026-global-scam-intelligence-report-warns-online-scams-have-become-a-cross-platform-cybercrime-industry/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4991