Infoblox has released its 2026 Threat Landscape Report, revealing that cybercrime has evolved into an industrialized criminal economy that enables attackers to operate faster, scale more efficiently, and evade traditional defenses. Frontier AI, specialized criminal services, and hidden infrastructure are accelerating this transformation, compressing the time defenders have to respond.
Nearly 25% of 120 million newly observed domains were high or critical risk, reflecting massive disposable infrastructure fueling cybercrime.
Traffic distribution systems (TDSs) impacted more than 95% of networks, routing victims to malware, phishing, and scam attacks.
88% of threat-related domains were observed in only one customer environment, with 44% active for just a single day.
65% of Infoblox Threat Defense customers queried domains associated with residential proxy networks used to disguise malicious activity.
Scam-related domains increased 62% year over year, driven by brand impersonation, identity theft, and financial fraud.
The report draws on trillions of DNS queries and billions of underground criminal transactions.
Infoblox, the leading platform for preemptive security and critical network services, today announced the release of its 2026 Threat Landscape Report, revealing that cybercrime has evolved into an industrialized criminal economy that enables attackers to operate faster, scale more efficiently and evade traditional defenses. Frontier AI, specialized criminal services and hidden infrastructure are accelerating this transformation, compressing the time defenders have to respond, and exposing the limits of traditional detect-and-respond security strategies.
The report examines cybercrime through four dimensions: the industrialized services powering attacks at scale, the hidden infrastructure enabling evasion, the evolving lures reaching victims and the expanding attack surfaces opening new footholds inside the enterprise. Together, these four perspectives reveal how modern cybercrime operates and what organizations must do to stay ahead of it.
Drawing on trillions of DNS queries, billions of underground criminal transactions and extensive threat research, Infoblox Threat Intel identified the trends reshaping how modern cybercrime operates, finding that:
Nearly 25 percent of 120 million newly observed domains were high or critical risk, reflecting the massive scale of disposable infrastructure fueling modern cybercrime.
The most prevalent threat, impacting more than 95 percent of networks, was traffic distribution systems (TDSs), ubiquitous and difficult-to-detect infrastructure that routes victims to targeted malware, phishing and scam attacks.
88 percent of threat-related domains were observed in only one customer environment, while 44 percent were active for just a single day, illustrating the scale of domain weaponization and the growing reliance on short-lived infrastructure designed to outpace defenders.
65 percent of Infoblox Threat Defense™ customers queried domains associated with residential proxy networks, which attackers use to disguise malicious activity as legitimate consumer internet traffic, allowing attacks to blend into everyday internet activity and evade detection.
Scam-related domains increased 62 percent year over year, driven by brand impersonation, identity theft and financial fraud.
"This year's report documents the cybercrime machine, a globally connected criminal economy where frontier AI, specialized criminal services and hidden infrastructure have transformed how attacks are created, purchased and deployed," said Dr. Renée Burton, vice president, Infoblox Threat Intel. "The most important shift is not that attackers have become more sophisticated. It's that sophisticated capabilities have become widely accessible, changing the pace of cybercrime and challenging security strategies built primarily around detection and response."
The report illustrates how cybercrime has evolved from isolated attacks into an interconnected criminal ecosystem fueled by specialization, automation and shared infrastructure. As these capabilities continue to spread, organizations must rethink long-held assumptions about how cyberthreats emerge, spread and can be disrupted.
About Infoblox
Infoblox is a leading platform for preemptive security and hybrid, multi-cloud networking that delivers enterprise resilience and agility. Trusted by over 5,700 customers, including the majority of Fortune 100 companies as well as emerging innovators, Infoblox seamlessly integrates, secures and automates critical network services so businesses can move fast without compromise.
TechIntelPro empowers B2B technology decision-makers with the latest industry trends, deep insights, leadership perspectives and actionable intelligence to drive both organizational and professional milestones, and thrive on the tech pulse.
