The culture of exposure has blurred the traditional boundaries between hacktivism, cybercrime and influence operations
Cybercriminals are increasingly pursuing business disruption alongside money, and publicity alongside both.
The World Economic Forum’s Global Cybersecurity Outlook 2026, published in January in collaboration with Accenture, describes a shift that emerged over 2025 in the structure and behaviour of cybercrime collectives. An increasing number of actors, particularly younger ones, are actively pursuing business disruption alongside visibility and status within the cybercrime ecosystem. These groups frequently publicise their activities by announcing attacks, leaking stolen data or sharing screenshots on social media.
The report’s assessment is that this culture of exposure has blurred the traditional boundaries between hacktivism, cybercrime and influence operations. Groups increasingly frame their actions as activism to claim moral legitimacy and expand their online following, complicating both attribution and response.
The Global Cybersecurity Outlook 2026 is the fifth annual edition of the report, produced by the World Economic Forum in collaboration with Accenture and published in January. It draws on a survey conducted between 25 August and 1 October 2025, which received 873 responses from 99 countries. These were normalised to 804 qualified participants from 92 countries, including 316 chief information security officers, 105 chief executives and 123 other C-suite respondents.
Three blurred lines
The report identifies a second convergence running in parallel. Cybercriminals adopt and adapt the tools, tactics and procedures of state actors once these become publicly known. Conversely, some nation-states mask their involvement by collaborating with or attributing operations to criminal groups to maintain plausible deniability. Others leverage the capabilities of these actors to advance their own strategic objectives, often in exchange for turning a blind eye to their illicit activities.
Underlying both trends is the commercialisation of cybercrime. The report notes that cybercrime-as-a-service platforms continue to lower entry barriers and expand the scale, sophistication and impact of attacks.
The Global Cybersecurity Outlook 2026 also records that generative AI is accelerating the same process. Criminal actors are using it to automate and scale social engineering, producing realistic phishing emails, deepfake audio and video, and falsified documentation capable of evading conventional detection systems and human scrutiny. Models trained on compromised or breached datasets are being used to improve targeting precision and replicate authentic communication styles.
The report highlights one consequence with direct bearing on multilingual markets. By enabling the translation and localisation of social engineering tactics, these tools make impersonations more culturally authentic and convincing. Criminal networks that once focused primarily on speakers of widely used languages can now effectively target new populations in regions that were previously less vulnerable to such scams.
The cost at the top of the scale
In the Forum’s survey, ransomware remains the leading concern for chief information security officers, while chief executives have shifted their primary concern to cyber-enabled fraud. The report notes that many of the major cyber incidents of 2025 were driven by ransomware demands.
In the United Kingdom, retailers including Marks & Spencer, Harrods and Co-op suffered major operational disruption and data losses. The report’s principal case study is the August 2025 attack on Jaguar Land Rover, which halted global production for five weeks and affected more than 5,000 suppliers. The incident generated £196 million, or about $260 million, in direct cyber-related costs and contributed to a near 25 per cent fall in revenue. The wider UK economy absorbed an estimated £1.9 billion, around $2.5 billion, in losses, while the UK government extended a £1.5 billion loan guarantee to stabilise the supply chain.
The report also records attacks disrupting retail, manufacturing and, in one cited instance, nurseries.
Enforcement answers
Against this backdrop, the report documents an unusually active year for law enforcement.
The United Nations Convention against Cybercrime, adopted by the General Assembly in December 2024 after five years of negotiation, was opened for signature in 2025. The report describes it as establishing the first universal framework for investigating and prosecuting offences committed online, from ransomware and financial fraud to the non-consensual sharing of intimate images.
Four operations are cited in the report. INTERPOL’s Operation Serengeti 2.0, coordinated with 18 African countries and the United Kingdom, targeted ransomware, online scams and business email compromise, resulting in 1,209 arrests and the recovery of $97.4 million. The report notes that the operation was strengthened by collaboration with private-sector and non-governmental bodies, including the Forum-hosted Cybercrime Atlas.
Operation Secure, led by INTERPOL across 26 countries with private-sector partners, focused on infostealer malware. It led to the dismantling of 20,000 malicious IP addresses and domains, the seizure of 41 servers and 32 arrests. Both INTERPOL operations were conducted under projects funded by the United Kingdom’s Foreign, Commonwealth and Development Office.
Operation Endgame, coordinated by Europol and Eurojust, dismantled malware infrastructure spanning hundreds of thousands of infected computers and containing several million stolen credentials. Europol and Microsoft separately disrupted the Lumma infostealer ecosystem, affecting 394,000 infected machines and resulting in the seizure of more than 1,300 domains.
“Facing rapid innovation in tech combined with the transformative impact of AI, law enforcement cannot fight cybercrime in isolation,” said Valdecy Urquiza, secretary-general of INTERPOL, in the report. “Protecting communities now depends on true multistakeholder cooperation.”
Fraud as the common experience
The report’s survey data places fraud ahead of every other category as a lived experience rather than merely a reported risk.
Some 77 per cent of respondents reported an increase in cyber-enabled fraud and phishing over the year, while 73 per cent said that they or someone in their professional or personal network had been personally affected by cyber-enabled fraud in the previous 12 months. The most common forms were phishing, vishing or smishing, at 62 per cent; invoice or payment fraud, at 37 per cent; and identity theft, at 32 per cent.
Sub-Saharan Africa recorded the highest regional exposure, at 82 per cent, ahead of North America at 79 per cent.
The United Nations Office on Drugs and Crime and INTERPOL are co-organising a Global Fraud Summit in March 2026, intended to galvanise political and law enforcement commitments and cross-sector collaboration. The Forum’s Partnership Against Cybercrime, together with the Institute for Security and Technology, has published a systemic defence approach built on prevention, protection and mitigation.
Click Here For The Original Source.
——————————————————–
