Arkose Labs has released a sobering new report titled A Data-Driven Analysis of Threat Actor Behavior, which charts the disturbing evolution of modern digital fraud. Drawing on a full year of scammer behavioral data, the report does not merely outline patterns of malicious activity—it deconstructs the economics and strategy behind a now-mature criminal ecosystem. From coordinated campaigns timed around high-profile public events to AI-assisted phishing operations that mimic the cadence of real customer behavior, the findings lay bare the increasingly organized and profitable nature of cybercrime.
What emerges from Arkose Labs’ analysis is a picture of scammers as savvy, entrepreneurial actors exploiting the digital world’s loopholes with alarming effectiveness. These aren’t isolated hackers tinkering from dark basements; they are part of a thriving fraud economy. A single scammer, targeting just five gaming platforms with account takeover attacks, can now earn on average over $145,000 annually. In certain regions, like El Salvador, threat actors focusing on gaming platforms can out-earn local software developers twentyfold. Their strategies aren’t improvised—they’re tested, iterated and optimized with the precision of modern tech startups, supported by global crime-as-a-service infrastructures and fueled by rapid AI adoption. Notably, the use of agentic AI systems has enabled adversaries to scale phishing schemes into full-fledged business models, reducing manual labor and increasing attack frequency.
Arkose Labs documents distinct seasonal patterns in the scam economy. A 309% spike in account sign-up attacks during Q4 2024 was closely tied to the holiday shopping rush, when bot-generated traffic blends easily with legitimate consumer activity. Similarly, Q3 attacks surged 48%, aligned with major U.S. events such as the Super Bowl and national elections, reflecting how fraudsters optimize timing for maximal disguise and psychological impact. By emulating real user behavior—complete with geographic diversity and session mimicry—scammers hide in plain sight, often exploiting common entry points such as account registration, login flows, and user profile updates.
The five industries most under siege are also the most digitally dependent: technology, social media, gaming, retail and fintech. Attack origination data points to the United States, Vietnam, Great Britain, Germany and Thailand as key hubs, underlining that the threat is both global and decentralized. These findings underline the importance of viewing fraud as a transnational issue—not merely a technical one. Moreover, the report argues persuasively that the current over-cautious stance toward technological adoption in the cybersecurity world is creating asymmetry. While defenders debate privacy protocols, compliance barriers and ethical limits on automation, attackers race ahead with operational agility and far fewer constraints.
But the report isn’t entirely grim. Arkose Labs highlights case studies where enterprises have managed to reverse the economics of fraud. By implementing countermeasures that raise the cost of attack—such as continuous authentication, adversarial machine learning, and deceptive telemetry—some firms have successfully disrupted scammers’ profit motives. These companies aren’t just protecting data—they’re reshaping attacker behavior by making exploitation unprofitable. The emphasis is clear: if the cost of fraud remains low and the rewards high, adversaries will only multiply. But if security and risk teams can raise the price of each scam attempt, they stand a fighting chance at shifting the balance.
This report should be mandatory reading for CISOs, fraud managers, and risk officers in any enterprise with a digital surface area. The fraud economy isn’t just adapting—it’s scaling. And unless the response matches that ambition, enterprises will continue to hemorrhage data, dollars and trust. Arkose Labs’ report is more than a threat briefing; it’s a strategic diagnosis of a metastasizing problem—and a call to reclaim digital territory from an enemy that has learned to move faster than we’re willing to.