Australian intelligence agency: AI makes online scams easier, with a cybercrime report every 6 minutes

The Australian Signals Directorate (ASD), Australia's signals intelligence and cyber security agency, has published the seventh edition of its Annual Cyber Threat Report. It covers the 2025–2026 financial year, which ended on 30 June, and describes threats observed by the Australian Cyber Security Centre (ACSC).

Key figures

Over 12 months the ACSC received more than 82,000 cybercrime reports, or one every 6 minutes on average. Specialists also responded to 1,524 cyber security incidents, 20% more than a year earlier.

The centre sent more than 4,400 alerts to potential victims, nearly 80% more than the year before. Those alerts helped identify 362 incidents before their impact could grow.

The average cost of a cybercrime reported by Australian businesses was A$93,500 (up 16%). For medium-sized businesses it was A$141,300, 45% more.

Not every reported crime involved artificial intelligence. The statistics show the overall scale of the threat, while AI is one of the factors changing how offenders operate.

How AI helps criminals

According to the report, AI most often supports social engineering: manipulating people to obtain money, login details or access to company systems. Generative models can write phishing messages without the usual language errors, tailor them to the recipient and use information from social media. A criminal can use this to pose as a boss, colleague or family member. Realistic AI-generated voices and video make the scam more convincing.

Australian experts describe, among other things, deepfakes of well-known people promoting fake investments. In June, a scam was also exposed involving a fake website of an Australian broadcaster, with fabricated articles and the likenesses of recognisable people.

AI also appears at the technical stage of attacks: it can analyse code, look for vulnerabilities and help prepare tools to exploit security flaws. The report describes a criminal group whose activity was disrupted in 2025 by a US company developing AI systems. The criminals used its tools to partly automate attacks, from identifying targets to attempts to take over networks. The ASD notes that the full effectiveness of these actions has not been established.

Less time to react

The ASD says the time between a vulnerability being disclosed and criminals exploiting it is getting shorter. In some cases attacks were observed within 48 hours of a patch or mitigation advice being released. AI could speed this up further.

The ASD recommends regular updates, using passkeys or multi-factor authentication, and restricting access to sensitive systems. AI can also help defenders by detecting suspicious behaviour and analysing threats.

What this means for you

The report concerns Australia, and its figures do not describe the situation in the UK. However, the methods it describes, such as fake messages, deepfakes and impersonation of loved ones, are not limited to one country. The ASD's advice is universal: keep software updated, turn on multi-factor authentication or passkeys, and be cautious about unexpected requests for money or data.