Norton reports: Top five ways scammers have used AI and deepfakes in 2025

Gen, a global leader powering Digital Freedom with a family of trusted brands including Norton, Avast, LifeLock, MoneyLion and more, today released its Q3 2025 Gen Threat Report, looking at trends from July through September.

Gen recorded 140,000 AI-generated phishing sites, a surge in AI-created scam text message campaigns, and a 82% increase in breach incidents.

Gen also blocked about 37 million device-fingerprinting attempts each month, protecting consumers from being tracked across sites even without cookies.

The findings reveal a threat landscape that is increasingly personal, as attackers use AI to automate persuasion and harvest high-value credentials across the web.

“AI has changed the scale and speed of cybercrime,” said Siggi Stefnisson, Cyber Safety CTO at Gen. “It is being used to mass-produce scams, tailor ransomware, and target people with precision we have never seen before.

Our mission is to stay one step ahead, using AI for protection rather than deception, and to bring real-time defense to every moment people live and work online.”

AI-Powered Phishing Factories

One of the strongest trends this quarter was the rise of AI-built phishing sites that look and feel just like real brands. Gen threat researchers call these “VibeScams” because their success depends less on coding and more on convincing. With AI web builders, criminals can now create high-quality brand-look-a-like phishing sites in minutes instead of hours.

Since January 2025, Gen has blocked more than 140,000 of these AI-generated scam sites. Activity remained high in Q3, with the United States, France, Brazil, and Germany among the top targets. A typical case begins with a fake delivery or payment message that leads to a look-alike website asking for card details, showing how easy it has become for scammers to mass-produce deception at scale.

Data Breaches Shift to “Quality over Quantity”

Breach activity rose sharply, with breach events up 82% quarter over quarter. Attackers are prioritizing precision data fueled account takeovers and fraud: 83% of breaches contained passwords, while basic contact detail breaches declined.

Identity misuse alerts from Gen telemetry reveal the same pattern. Payday loans accounted for 32% of financial-related identity theft attempts, followed by fraudulent credit card applications, protective lock blocks and unauthorized bank account updates. Criminals are increasingly targeting fast-cash products and exploiting third-party integrations to access sensitive data.

Text Scams Get Smarter

Text-based fraud continues to rise, driven by automation and AI-generated messages that seem increasingly authentic. Gen Threat Labs analyzed hundreds of millions of SMS messages this quarter and found recurring lure patterns designed to exploit urgency and routine. The vast majority were financially motivated, aiming to extract a small payment, capture card details, or take over accounts.

The top five campaigns alone accounted for 26% of all malicious texts and included fake job offers, refund scams, tax and fine alerts, investment pitches and delivery notifications. These campaigns often begin with identical mass texts that funnel victims to fake customer service chats or voice calls, turning a few words on a screen into full-scale deception.

Gen’s telemetry shows that this wave of mobile-first fraud is accelerating, with criminals pairing AI-written texts with cloned voices or chatbots to extend scams across multiple channels.

Digital Fingerprints on the Rise

Even as consumers clear cookies and use privacy tools, digital tracking continues to evolve. Digital fingerprints are like a device’s unique signature, a mix of settings and details that can identify someone online even without cookies. Gen’s telemetry shows an average of 247 million trackers blocked each month and a steady 37 million digital fingerprints detected monthly.

The Gen family of trusted Cyber Safety brands, such as Norton and Avast, helps protect consumer privacy from fingerprinting with products that spot these signals and block them or mask the information they seek. Discussions about encryption have resurfaced in the UK and EU, with new worries that proposed backdoors – ways for authorities to access encrypted data – could make people’s data less private and secure.

Protecting Yourself and Your Business

The quarter also included a major win for people and small businesses. Gen researchers discovered a fatal flaw in the Midnight Ransomware encryption and released a free decryptor that allows victims to recover files without paying.

The impact of ransomware can reach far beyond large organizations, as small businesses and individual consumers often face the greatest losses when critical systems or personal files are locked without backup.