Visa, a multinational firm into payment card services says Artificial intelligence enabled scams have emerged as the fastest-growing source of consumer payment fraud globally as cybercriminals increasingly target people.

Visa stated this in its Mid-year 2026 Biannual Threats Report released on Wednesday in Lagos.

The report said scammers were increasingly using AI tools and social engineering tactics to manipulate consumers into authorising fraudulent payments themselves.Premier League Fixtures

It indicated that from July to December 2025, Visa identified nearly one billion dollars in scam-related activity, making scams the largest category of consumer payment fraud.

According to the report, fraudsters now impersonate trusted brands and institutions, create a sense of urgency and deceive victims into completing seemingly legitimate transactions.

The report said stronger network-level security had reduced opportunities for direct system compromises, forcing criminals to shift their focus to exploiting human trust.

It revealed that fraud involving device tokens declined by 9.6 per cent between July and December 2025, compared with the same period in 2024.

The report identified accelerating scams, growing use of AI in fraud, migration of attacks from technology to people, and evolving ransomware trends as key developments shaping payment security.

It stated that global ransomware activity rose by 26 per cent during the review period compared with the corresponding period in 2024.

However, only 23 per cent of ransomware victims paid ransoms, the lowest level on record, reflecting improved resilience and recovery capabilities, according to the report.

Commenting, Mr Paul Fabara, chief Risk and Client Services officer, Visa, said that payments at network level continued to get safer, but threats were evolving faster than ever

Fabara said criminals were increasingly using deception, urgency and AI-enabled tools to exploit trust, requiring stronger collaboration across the payments ecosystem.

Also, Andrew Uaboi, vice president and Cluster head, Visa West Africa, said AI had significantly lowered the barriers to entry for fraudsters.

“What once required deep technical skill can now be executed with a prompt,” Uaboi said.

He said intelligence-driven defence and coordinated action across the ecosystem were becoming increasingly critical to protecting consumers from emerging threats.

Kaspersky has released its Sustainability Report for 2024–2025, outlining how the company is working toward a safer and more resilient digital future.

The report reflects Kaspersky’s broader commitment to responsible business — protecting people and organisations from cyberthreats, supporting law enforcement cooperation, investing in secure technologies, and helping strengthen the digital resilience of societies and economies.

In 2024-2025, the company continued advancing digital sustainability and strengthening global cyber resilience, reducing thedisruption, financial losses and social risks caused by cyber incidents, and enabling safer and more stable conditions for digital adoption across economies and societies.

Over the period, the number of detected advanced persistent threat (APT) groups and operations has increased significantly — by 74% compared to 2023, supported by intelligence gathered through five dedicated Expertise Centers.

Building a safer cyberworld

A significant part of Kaspersky’s social impact comes from the company’s cooperation with global law enforcement agencies. During the reporting period, the company contributed to joint operations with INTERPOL and AFRIPOL that resulted in the arrest of more than 2,600 suspected cybercriminals.

From a sustainability perspective, this shrinks the opportunities attackers can exploit — making digital environments safer for governments, businesses and individuals, and lowering the long-term economic and social costs associated with cyber incidents.

During the reporting period, Kaspersky formalised its collaborations with AFRIPOL, signing a five-year cooperation agreement, and delivered cybersecurity training to law enforcement representatives from 23 African countries, covering the fundamentals of Security Operations Center (SOC) operations and advanced threat hunting techniques.

This capacity-building work has a compounding effect: as local teams become more capable of independently detecting and responding to threats, the overall resilience of the digital ecosystem increases, while the cost and duration of cyber incidents decrease over time.

Implementing future tech

To effectively protect people, businesses and public institutions from evolving cyberthreats, Kaspersky constantly improves its security solutions and conducts cybersecurity research to stay one step ahead of attackers.

In 2024–2025 the company was granted 155 patents, including 135 AI-related ones. Its global R&D team of around 3,000 employees also produced 373 research publications. Together, these efforts help advance the baseline of secure technologies available to the market.

This reduces systemic vulnerability in digital infrastructure and supports more stable technological adoption at scale.

Responsible innovation frameworks further reinforce this effect. By joining the European Commission’s AI Pact and supporting the UN Global Digital Compact, Kaspersky has aligned its development practices with emerging global governance standards.

This contributes to sustainability by helping reduce the risks of unsafe AI deployment, such as misuse, bias or system exploitation, which could otherwise undermine trust in digital transformation.

The company’s Cyber Immunity approach, implemented through KasperskyOS, adds another layer of long-term sustainability impact by shifting security from reactive protection to architectural resilience.

Instead of repeatedly patching vulnerabilities, systems are designed to be inherently resistant to compromise, which reduces maintenance overhead, lifecycle risk and resource inefficiency in securing digital environments.

Among the new product launches, the Kaspersky eSIM Store expanded the company’s offering beyond cybersecurity into mobile connectivity. By reducing reliance on physical SIM cards and making global mobile access more seamless, the solution supports more sustainable travel and digital lifestyles.

Together with that, Kaspersky also released Kaspersky Cloud Workload Security for protecting cloud workloads wherever they reside: on servers or virtual machines, or in private, public, or hybrid clouds, etc.

“At Kaspersky, we see cybersecurity not only as a technology issue, but as a social one. Every day, people rely on digital services to work, communicate, study, receive services and manage their lives and they need to be able to do this safely.

“That is why our sustainability agenda starts with our core expertise: protecting people, organisations and critical systems from cyberthreats. But it also goes further — through responsible innovation, transparency, partnerships and support for communities.

“This report shows how our technologies, research and cooperation with partners translate into practical impact: fewer risks, stronger resilience and a safer digital environment for everyone,” said Maria Losyukova, Head of ESG & Sustainability at Kaspersky.

Kaspersky researchers have uncovered an ongoing malware distribution campaign leveraging Steam Workshop and Wallpaper Engine, a popular Steam application used to create and share animated desktop wallpapers.

Researchers identified multiple infected wallpaper packages which had accumulated thousands of downloads. Steam users in China and Russia were primarily targeted, with other victims located in Singapore, Hong Kong, Germany, Vietnam, India and Canada.

The main goal of the attackers was stealing gaming accounts and deploying additional malware.

Steam Workshop is a built-in feature of the Steam gaming platform that allows users to easily find, install, and manage user-generated content like mods, custom maps, game items, and wallpapers. The Wallpaper Engine app supports several wallpaper formats, including videos, interactive scenes, web pages, and applications.

The application-based wallpaper feature allows executable programs to run directly on a user’s Windows computer, allowing attackers to distribute malicious software under the guise of legitimate content.

Kaspersky identified dozens of infected wallpaper packages available through Steam Workshop. Many of these packages had thousands or even tens of thousands of downloads.

There were two primary delivery methods that attackers used. In some cases, malicious executable files, DLLs, and scripts were bundled directly with the wallpaper package.

In others, attackers hid malware inside password-protected archives, with passwords embedded in archive names or configuration files. Once the wallpaper was installed, malicious payloads executed automatically.

For example, one of the malicious wallpaper samples discovered in December 2025 appeared to function legitimately at first, launching an embedded desktop game without any visible signs of compromise.

In the background, however, the wallpaper deployed the DarkKomet backdoor and installed a modified library designed to target Steam users: it harvested account information and hijacked active Steam sessions.

The attacks were likely conducted by multiple independent threat actors rather than a single group, and were not limited to a single malware family. Across multiple cases, Kaspersky detected malicious wallpapers distributing Lumma and Vidar infostealers and the RenEngine loader. Kaspersky’s security solutions detect and block all malware associated with this campaign.

“Trusted platforms can be abused to distribute malware: the attacks rely on users trusting content hosted within legitimate ecosystems. While many of the malware families involved are well-known, the delivery mechanism enables attackers to reach large numbers of potential victims through seemingly harmless content,” commented Maxim Starodubov, a cybersecurity expert at Kaspersky.