AI-driven cyber scams surge as phishing & fake updates rise

Norton has highlighted an escalating threat to internet users in the UK, following new data revealing significant increases in cybercrime activity globally in early 2025.

The latest Gen Threat Report, published by Gen, points to a 186% surge in breached personal records worldwide, while the number of user email breaches more than doubled, rising by 103%. The report warns that this trend is leaving individuals increasingly exposed, with cybercriminals gaining direct access to sensitive assets such as bank accounts and digital identities.

For UK consumers specifically, the report draws attention to a shift in criminal tactics. Attackers are moving away from broad-scale brute force intrusions to more targeted and sophisticated data theft. As a result, data compromise events where entire companies or platforms were breached rose by 36.12% in the first quarter of 2025 when compared to the previous quarter.

One of the more striking statistics within the report is that 1.19 million breached records were categorised as high or critical severity. These accounts were compromised to the extent that plaintext passwords were exposed, effectively "handing cybercriminals the keys to more than a million personal accounts."

Also noted in the report is a 466% increase in phishing incidents. Attackers are increasingly mimicking legitimate brands and communications, often leveraging artificial intelligence (AI) tools to craft convincing deception campaigns. Fake browser update scams grew by 1,700% during the same period, a development that underscores the rapidly changing tactics used by threats actors.

More than 4 million people were protected from so-called 'scam-yourself' attacks between January and March 2025. These attacks exploit victims by manipulating them into infecting their own devices, often through the use of AI-generated personas, deepfake influencers, or actors contacted via compromised accounts.

The report also describes a notable increase in the use of sophisticated infostealers such as Lumma Stealer, which make detection and prevention of data compromise more challenging. In the UK, blocked attacks involving banking malware surged by 76% over the same period, with attackers increasingly focusing on mobile devices and digital financial assets.

"Online threats are evolving at a startling pace," said Siggi Stefnisson, Cyber Safety CTO at Gen. "Attackers are moving away from broad, indiscriminate campaigns to highly personalized, AI-enhanced deception. Breached data and AI tools are giving cybercriminals just enough personal information and design sophistication to more easily manipulate people. That's why we constantly evolve our cybersecurity solutions to be an interactive partner in fighting scams and to be one step ahead of cybercriminals."

Norton's analysis of phishing represents a fast-growing threat, with nearly one in three scam submissions targeting users with phishing content. Security telemetry data reveals that cybercriminals are using dynamic DNS services, subdomain providers, and free website builders to craft websites that closely resemble legitimate login portals. These tactics make phishing harder to detect and defeat by both individuals and traditional security filters.

Scams often create a sense of urgency among potential victims by distributing emails that highlight supposed account problems or prompt users to review sensitive documents. While some phishing emails may contain obvious errors, the usage of trusted platforms and subtle subdomain tricks increases the likelihood of success.

The area of 'scam-yourself' attacks has seen rapid development, the report notes. Attackers are now embedding AI-generated personas and deepfakes into their strategies. Scam campaigns frequently employ interactive elements like fake CAPTCHAs to deceive people into giving device permissions or downloading malicious software.

Fake browser update scams, a notable subset of these attacks, witnessed a dramatic rise. Gen recorded a growth of over 17 times the number of incidents reported in the previous quarter. These scams misleadingly instruct users to install malware in the guise of legitimate browser updates.

Financial threats have also intensified, with mobile banking malware exploiting accessibility features to overlay fake login screens and steal credentials, including those for cryptocurrency wallets. There was also mention of global attacks leveraging AI-generated deepfake videos, such as those timed around the US presidential inauguration, which resulted in crypto thefts nearing USD $4 million across more than 2,000 transactions.

The report concludes that cybercriminals' increasing dependence on breached personal data and AI-enhanced deception is making their operations more effective and more difficult to counter. Norton experts have stressed that the solution requires innovation in cyber safety tools, not only to block threats but to support users in recognising and resisting new types of scams.