More than one in three login attempts across Asia-Pacific were flagged as high or critical risk, according to new research from Akamai — a rate well above what the company is tracking elsewhere in the world.
Key Takeaways
- 36.4% of login attempts in APAC were flagged high or critical risk, against a 26.6% global average.
- Financial services made up 12.5% of regional attack activity, split between banking (6.4%) and fintech (6.1%).
- Scam detections rose from 3.2 million to 6.4 million as the average phishing campaign’s lifespan fell from 48.3 to 22 days.
Akamai put the region’s login-risk rate at 36.4%, compared with a global average of 26.6%. Reuben Koh, Akamai’s director of security technology and strategy for APJ, pointed to the gap as a sign that credential-based attacks are being pointed at the region with unusual intensity, rather than APAC simply catching a share of worldwide attack traffic.
Banking and fintech absorb the bulk of attacks
Financial services firms in APAC accounted for 12.5% of all the attack activity Akamai tracked in the region over the period. Banking made up 6.4% of that figure and fintech 6.1%, putting the two sectors within a point of each other as targets. Koh’s team reads the split as confirmation that attackers now treat traditional banks and newer fintech platforms as equally worthwhile marks, rather than concentrating on one at the expense of the other.
Scams overtake phishing as the region’s leading threat
The clearer shift in Akamai’s data is the rise of scams as a category distinct from classic phishing. Detections climbed from 3.2 million to 6.4 million, doubling over the period Akamai measured. At the same time, phishing campaigns are burning out faster: the average lifespan of a campaign fell from 48.3 days to 22 days, which Koh’s team takes as a sign that defenders are getting quicker at spotting and taking down malicious domains, forcing attackers to cycle through new ones sooner.
That churn shows up clearly in one Southeast Asia case Akamai flagged: a single gambling-redirect campaign ran through 2,157 separate URLs, routing victims through a constantly refreshed set of addresses to stay ahead of takedowns and blocklists.
Attack scale varies wildly within a single incident
Akamai also recorded two attacks launched against the same target at the same time, illustrating how differently attackers can operate even in one incident: one generated 42,000 requests, the other just 164. The gap suggests APAC organisations are facing everything from brute, high-volume credential-stuffing runs to quieter, more targeted attempts designed to stay under the radar — often aimed at the same systems within hours of each other.
For banks, fintechs and other regional targets, the combination of a rising high-risk login rate, faster-moving scam campaigns and attacks of wildly different scale points to a threat picture that is getting harder to profile with a single set of defences.
