Infoblox’s 2026 Threat Landscape Report reveals that cybercrime has evolved into a globally connected criminal economy where attackers are leveraging frontier AI, specialized services and hidden infrastructure to create, scale and deploy attacks faster than traditional defenses can respond.

According to the report, the biggest change in the threat landscape is not simply that attackers have become more advanced but that sophisticated capabilities are becoming more accessible. This shift is allowing more threat actors to use tools and services that were previously limited to highly skilled adversaries.

“This year’s report documents the cybercrime machine, a globally connected criminal economy where frontier AI, specialized criminal services and hidden infrastructure have transformed how attacks are created, purchased and deployed,” said Dr. Renée Burton, vice president of Infoblox Threat Intel. “The most important shift is not that attackers have become more sophisticated. It’s that sophisticated capabilities have become widely accessible, changing the pace of cybercrime and challenging security strategies built primarily around detection and response.”

The report examines this changing cybercrime ecosystem through four dimensions: the industrialized services powering attacks at scale, the hidden infrastructure enabling attackers to evade detection, the evolving lures used to reach victims and the expanding attack surfaces creating new opportunities inside organizations.

Drawing on trillions of DNS queries, billions of underground criminal transactions and extensive threat research, Infoblox Threat Intel identified several trends shaping modern cybercrime.

The report found that nearly 25% of 120 million newly observed domains were classified as high or critical risk, highlighting the scale of disposable infrastructure being used to support attacks. Traffic distribution systems (TDSs) emerged as the most prevalent threat, impacting more than 95% of networks. These systems route victims to targeted malware, phishing and scam attacks while remaining difficult to detect.

Infoblox also found that attackers are increasingly relying on short-lived infrastructure designed to stay ahead of defenders. The report showed that 88% of threat-related domains were observed in only one customer environment and 44% were active for just a single day.

The report also identified the continued use of residential proxy networks as a method for hiding malicious activity. According to the findings, 65% of Infoblox Threat Defense™ customers queried domains associated with residential proxy networks, allowing attackers to make malicious activity appear like legitimate consumer internet traffic.

Scam activity also continued to expand, with scam-related domains increasing 62% year over year. Infoblox attributed the growth to brand impersonation, identity theft and financial fraud.

The company said these findings demonstrate how cybercrime has moved beyond isolated attacks into an interconnected criminal ecosystem fueled by specialization, automation and shared infrastructure.

As these capabilities continue to spread, Infoblox said organizations must reconsider how they understand, identify and disrupt modern cyberthreats rather than relying primarily on traditional detection and response approaches.