A recent cybercrime report highlights how criminals are evolving as AI plays a growing role in modern scams.

Cybersecurity group CrowdStrike tracked 281 hacker syndicates, including 24 new groups, for its 2026 Global Threat Report.

The report indicates that hackers and scammers have become increasingly sophisticated, largely because of AI. This year, attacks by AI-enabled criminals grew 89% from the previous year.

AI tools used in cybercrime include:

• Convincing phone and email scams: AI creates realistic phone calls, emails and messages to trick victims into revealing sensitive information.
• Automated attacks: AI automatically performs tasks once criminals gain access to a victim’s device or network.
• Collecting sensitive information: AI tools collect usernames and passwords, giving criminals access to accounts or networks.

Empangeni woman loses life savings

In one recent incident, an Empangeni woman had her credit card maxed out and her savings drained after she fell victim to a sophisticated scam and downloaded what appeared to be a legitimate South African Airways (SAA) app from the Google Play Store.

The woman told the Zululand Observer that she visited the SAA website to search for flights to Cape Town. Shortly afterwards, she received a WhatsApp call from someone impersonating an SAA employee. The caller knew her personal information, including her ID number, and prompted her to download an app.

While the app was installing, the woman lost control of her phone. She could not end the call and her touchscreen was unresponsive.

She later received SMS notifications from her bank and learnt her money had been stolen.

Cybercrime experts later told her she most likely installed malware on her phone when she downloaded the app.

Cyberattacks spreading faster

According to the report, the average breakout time – when a cybercriminal expands their hold from one laptop to an entire network – is now 29 minutes, with the fastest recorded at just 27 seconds. This leaves organisations little time to detect an attack and stop it before it spreads.

The 29-minute breakout time represents a 65% increase in attack speed compared to the previous year.

In one incident highlighted in the report, an e-crime group called Chatty Spider started extracting data within four minutes of gaining access.

Shift away from traditional malware

Despite the KZN woman’s experience, the report found that viruses are no longer the primary tool used to compromise computers or funds, with 82% of detected attacks being malware-free.

Instead of relying on traditional viruses, criminals focus on stealing passwords to access accounts and secure company property, such as confidential files.

Targeting network edge devices

Devices such as firewalls, routers and VPN equipment have become primary targets for hackers. These devices, which often act as a gateway between an internal network and the internet, frequently lack the security protections found on employee computers, making them easier to compromise.

The report found that known cybercrime groups in China targeted internet-facing devices in 40% of their attacks.

Global targets

According to the report, 55% of tracked incidents occurred in North America, 18% in East and South Asia, 7% in Europe, 5% in South America and only 2% in Africa.

The technology sector was hit hardest (23%), followed by manufacturing (15%), retail (12%) and financial services (11%).

Read the full report here.

Breaking news at your fingertips… Follow Caxton Network News on Facebook and join our WhatsApp channel.

Nuus wat saakmaak. Volg Caxton Netwerk-nuus op Facebook en sluit aan by ons WhatsApp-kanaal.