Financial services emerged as APAC’s most targeted industry. Banking accounted for 6.4% of observed attack activity and fintech 6.1%, together representing 12.5% of attacks in the region. Malware, advanced persistent threats, ransomware and botnets were among the principal threats identified.
Akamai’s Fraud and Abuse State of the Internet (SOTI) Security report, noted that one campaign generated 42,000 automated requests over seven days, apparently to validate credential databases at scale, while a separate “low-and-slow” campaign made only 164 account-creation requests in an effort to evade threshold-based rate limits and establish synthetic identities or money-muling accounts.
Reuben Koh, director of security technology and strategy, APJ, at Akamai, warns fraudsters are becoming more adept at blending into normal customer activity.
Reuben Koh
“What looks like a routine login, a new account or a small payment could be part of a larger attack, with AI and automation making these schemes easier to scale and blend in. The challenge for businesses is that suspicious activity does not always look suspicious in isolation.” Reuben Koh
AI reshapes fraud
The report describes a structural shift in cybercrime, with AI and automation enabling fraud operations to scale while evading conventional perimeter defences. Globally, online scam detections doubled year on year, from 3.2 million to 6.4 million, overtaking phishing for the first time in the first quarter of 2026.
Attack lifespans are also shortening. The average operational window for phishing campaigns fell from 48.3 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026, reducing the time available for security teams to detect and disrupt campaigns.
In Southeast Asia, among the 2,157 URLS connected to campaigns that exploited travel-related searches, the campaigns targeted cryptocurrency investors, financial institutions, consumer brands and commerce businesses for credential theft, payment fraud and account takeover.
Defence implications
Akamai recommends that organisations adopt intent-based behavioural detection across the full customer journey, from registration and authentication through to payments. Stronger bot management can help identify automated account creation, credential stuffing and fraudulent transactions, including low-volume attacks designed to avoid detection.
The company also urges security, fraud-prevention and business teams to share threat intelligence and examine shared infrastructure and behavioural patterns across campaigns. The findings reinforce the need to detect coordinated fraud early while preserving a seamless experience for legitimate customers.
