- NordVPN blocked over 5 million malware attempts in January alone
- 99% of phishing attacks impersonate just 300 brands
- AI tools and fraud kits mean attackers no longer need advanced skills
We are well past the days when a cyberattack meant mass-mailing a poorly spelled virus. In 2026, cybercriminals are heavily leveraging generative AI to make their scams highly personal, industrializing fraud on a massive scale.
That is the stark warning from the Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape, published today by NordVPN. Analyzing threat intelligence data from the first half of the year, the prominent cybersecurity and best VPN provider uncovered that the most exploited vulnerability right now isn't outdated software; it is human trust.
Armed with unrestricted AI models and ready-to-use fraud kits, scammers have drastically lowered the entry barrier for digital crime. The focus has decisively shifted from complex technical exploits to highly targeted campaigns that weaponize greed, urgency, and our faith in familiar brands.
"Bad actors are weaponizing our natural instinct to believe what we see and hear," says Marijus Briedis, CTO at NordVPN, warning that these attacks no longer require advanced skills or significant resources. "Anyone with an internet connection can launch them."
It's in this context that "A single human error is now more likely than ever and likely to be more devastating than ever," Briedis added.
The numbers behind the threat
NordVPN analyzes 12 million unique URLs daily, blocking an average of 130,000 malicious pages every 24 hours before they can reach a user — a critical defense mechanism as NordVPN’s antivirus tool continues to block massive volumes of malicious sites.
Malware remains the single largest threat by volume. January 2026 saw a massive peak of over 5 million blocked attempts as attackers preyed on post-holiday shoppers. Most of these were infostealers aiming to grab saved login credentials.
The US was the hardest hit with 4.89 million attempts across the first half of the year, followed by the UK (2 million) and Germany (1.32 million).
Phishing is equally rampant. NordVPN blocked over 4.4 million phishing attempts in the first half of the year, noting that 99% of these attacks impersonate a narrow list of just 300 brands, often disguised as fake job recruiter campaigns.
Microsoft was the most impersonated company (16.12%), followed by Roblox (12.32%), Google (9.94%), and Netflix (5.99%). Adding to the danger, attackers frequently exploit the trusted .com domain, which accounts for 43.2% of all intercepted scams.
NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.
Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.
📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.
Hijacked sessions and the Dark Web
While users are increasingly wary of downloading fake apps or clicking shady links hidden in pirate sites, attackers are finding stealthier ways in.
Between January 1 and May 26, 2026, a staggering 94 billion cookies were exposed online. Of these, 1.2 billion were active session cookies, which cybercriminals can use to hijack accounts without needing a password, often completely bypassing multi-factor authentication (MFA).
Once data is stolen, it is swiftly commodified. Using its Dark Web Monitoring tools, NordVPN identified 8.4 million compromised accounts in just 90 days.
Frighteningly, over 47% of the exchanged data involved physical addresses and full names, allowing attackers to weave digital and real-world identifiers together into comprehensive victim profiles.
Telephony isn't safe, either. Between the service's launch and June 16, NordVPN blocked nearly 29,000 scam calls and issued spam warnings to over 525,000 users.
How to stay safe
Because technical barriers for criminals are lower than ever, defensive strategies must evolve. NordVPN's report stresses that consumer protection now requires a mix of both technological defenses and behavioral resilience.
Alongside using security tools like a virtual private network (VPN) and antivirus software, users must cultivate a healthy skepticism. If a message, email, or website demands urgent action or offers something too good to be true, pause and verify.
In the age of AI-driven fraud, a moment of hesitation is your best line of defense.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
