INTERPOL: Phishing, Ransomware and AI Scams Sweep Asia-Pacific

INTERPOL has released a new report revealing a “ dramatic increase ” in cybercrime in Asia and the South Pacific, with phishing , ransomware and AI-powered scams the dominant threats. According to the Asia and South Pacific Cyber ​​Threat Assessment Report 2025/2026 , in more than half of its member countries, cybercrime now accounts for at least 30% of all recorded crimes . The report covers the period January 2024 to March 2025 and is based on data from member countries and partner telemetry.

See also: QR Code Scams: New phishing scams baiting breaches

Phishing is emerging as the most prevalent and financially devastating form of cybercrime in the region. 33% of countries reported more than 10,000 phishing incidents during the period, while 5.5 out of 1,000 people click on malicious links each month — almost double the global average of 2.9 per 1,000. The main targets are cloud applications and financial services, reflecting the region’s rapid digitalization.

Neal Jetton, Director of Cybercrime at INTERPOL, said: “The findings of this report highlight a rapidly evolving cyberthreat landscape, where cybercriminals are leveraging artificial intelligence, ransomware-as-a-service and sophisticated social engineering techniques on an industrial scale.” This statement captures a critical shift: attacks are no longer isolated, but automated, scalable and organized like businesses.

INTERPOL: Ransomware, Deepfakes and DDoS at record

INTERPOL records over 135,000 ransomware attacks in 2024 in the region, with the main targets being the real estate , manufacturing and financial services sectors. Ransomware groups are even exploiting companies’ regulatory obligations to increase pressure during extortion negotiations — a tactic that demonstrates the entrepreneurial mindset of cybercriminals. Meanwhile, DDoS attacks increased by 92% year-on-year in 2024, while system intrusions accounted for around 80% of all data breaches , with malware being found in 83% and ransomware in 51% of them.

See also: UNC1151 launches Gmail phishing campaign to steal 2FA passwords

Of particular concern is the explosive rise of deepfakes. Discussions about deepfake on cybercrime forums and Telegram used by Southeast Asian perpetrators increased by 600% between February and June 2024.Criminal organizations in Myanmar, Cambodia , and Laos are using deepfakes in “romance baiting” scams, combining AI personas and social engineering to defraud victims worldwide. Losses from these operations are estimated at $37 billion in regional cybercrime losses, while scam centers generate nearly $40 billion in revenue annually.

The most prevalent malware detected in the region include RedLine, Lumma, LokiBot, Negasteal and ZBot, with banking trojans and information stealers being the second most prevalent cybercrime category. Attackers also exploit misconfigured systems, weak encryption, insecure APIs , and inadequate monitoring to compromise target networks. Overall, an estimated 6.5 billion cyberthreats were detected and addressed in the region based on partner telemetry.

INTERPOL a critical factor allowing criminals to exploit weak links. The rapid adoption of mobile banking, cloud services and digital financial services has expanded the attack surface much faster than defenses have improved. In response, law enforcement authorities in the region — with support from INTERPOL — are scaling up joint efforts through coordinated operations against cybercrime infrastructure, collaborative investigations and specialized training initiatives.

See also: Phishing campaign imitates Adobe Document Cloud and installs malware

For organizations operating in the region or working with counterparts there, the recommendations are clear: strengthen anti- phishing defenses with multi-factor authentication and user education, harden against ransomware with offline backups and network segmentation, prepare for AI-impersonation fraud through out-of-zone verification for payment orders, and reduce DDoS exposure with traffic scrubbing and resilient hosting. Prioritizing intrusion detection and vulnerability management remains critical, as system breaches are the dominant driver of data breaches in the region.