NordVPN report reveals how AI is accelerating consumer fraud

A new report from NordVPN highlights a dramatic shift in cybercrime, revealing that bad actors are increasingly weaponising artificial intelligence to industrialise fraud and target everyday consumers on an unprecedented scale.

Covering the first half of 2026, Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape details how modern cyberattacks have moved away from generic mass emails. Instead, criminals are using accessible AI tools and ready-made fraud kits to exploit human trust, urgency and familiarity with popular brands.

“Bad actors are weaponising our natural instinct to believe what we see and hear,” said Marijus Briedis, CTO at NordVPN. “These attacks no longer require advanced skills or significant resources. A single human error is now more likely than ever and likely to be more devastating than ever.”

The report highlights staggering statistics regarding the scale of today’s digital threats. Analysing roughly 12 million unique URLs daily, NordVPN blocks an average of 130,000 malicious pages every day.

Malware emerged as the largest threat by volume, with attackers targeting post-holiday shoppers in January alone with over 5 million blocked attempts. Globally, the United States bore the brunt of these attacks with 4.89 million incidents, followed by the United Kingdom at 2 million, and Germany at 1.32 million, with most campaigns deploying infostealers to harvest saved credentials.

Phishing also remained rampant, with over 4.4 million attempts blocked during the first six months of the year. Remarkably, 99 percent of these phishing campaigns impersonated just 300 trusted brands, led heavily by Microsoft, Roblox, Google, and Netflix.

Furthermore, the report revealed that 94 billion cookies were exposed online between January and May 2026, including 1.2 billion active session cookies that allowed hackers to bypass traditional passwords and multi-factor authentication entirely.

Dark web monitoring tools uncovered 8.4 million compromised accounts in a 90-day window, with over 47 percent of that data containing physical addresses and full names.

In addition to tracking these threats, NordVPN’s new publication provides actionable guidelines designed to help consumers establish better technological defences and behavioural resilience against emerging risks.

Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape.