Akamai (Nasdaq: AKAM) said phishing campaigns are becoming far shorter-lived, a shift that can narrow the response window for enterprise fraud and security teams. The company reported that the average phishing attack lifespan fell from 48 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026.
The finding appears in Akamai’s new AI-Driven Digital Deception: The Fraud and Abuse Report 2026, which examines fraud activity observed across the company’s cybersecurity infrastructure. Akamai said threat actors are using AI and automated infrastructure to evade traditional security perimeters, exploit account workflows and abuse the trust associated with corporate brands.
For security operations teams, the shorter lifecycle is significant because controls built around static blocklists and manually updated indicators can lose relevance more quickly. Akamai attributed the faster turnover in part to phishing-as-a-service toolkits, bulk domain registration and infrastructure that rotates rapidly. Those practices can require organizations to put more emphasis on current behavioral signals and timely investigation rather than relying only on known malicious domains.
The report said online scams surpassed traditional credential-harvesting phishing for the first time in the first quarter of 2026. Scam detections rose from about 3.2 million to 6.4 million, according to the company. The activity covered tactics including fake retail domains, social-recruitment traps and spoofed event portals. The finding broadens the exposure beyond a single malicious email or a conventional login page: the company described fraud campaigns that can exploit multiple customer interactions before a victim reaches a protected account workflow.
Akamai also found that nearly 70% of phishing threats impersonated high-technology, financial-services and commerce brands. High technology represented 41.6% of that total, followed by financial services at 18.9% and commerce at 8.4%. The figures underline that fraud programs must coordinate with identity, web-security and brand-protection functions when attackers target customer-facing services. Teams that isolate those functions may have a less complete view of the domains, login attempts and application behavior associated with a campaign.
Account activity presented another operational concern. The company said high- and critical-risk login activity made up 26.6% of recorded login attempts, while account-verification requests accounted for 40% of high- and critical-risk login traffic. Akamai said the pattern indicates adversaries may be validating email addresses before launching larger credential-stuffing campaigns. Commerce accounted for 41.1% of total login attempts in the data, which the company linked to the opportunity for account takeover, credential validation and loyalty-point abuse.
The research does not establish that any one control will prevent those attacks. Akamai recommended behavioral inspection across the account lifecycle to identify low-and-slow credential stuffing and card testing, and it cited microsegmentation as part of a broader ransomware-mitigation strategy. Organizations will still need to assess how those recommendations fit their identity architecture, application telemetry and incident-response process. The company did not provide comparative results for those measures in the report.
The practical change for enterprise defenders is a smaller margin for detection and disruption. As phishing infrastructure turns over more rapidly, security teams may need to prioritize telemetry that identifies suspicious behavior while a campaign is active, then connect that evidence to account, network and application controls before attackers can reuse the same infrastructure elsewhere.