The usual suspects:
Everyday online threats in numbers
You face cybersecurity threats every day — even if you don’t notice them. What should you be worried about in your daily online life?
NordVPN’s next-gen antivirus feature guards you against common online threats — but just how much danger is the average internet user exposed to every day? NordVPN’s researchers have analyzed aggregated data from our next-gen antivirus over a prolonged period to determine the kinds of threats that you’re most likely to encounter on the internet.
Malware, phishing attempts, and scams blocked
Every month, NordVPN's next-gen antivirus blocks millions of attempts to reach malicious domains. The table below shows how many unique threat encounters our users had each month, broken down by threat type. One "hit" represents a single device meeting a single dangerous domain.
Digital threats blocked in Q2 2026
| Period | Malware | Phishing | Scam | All threats |
|---|---|---|---|---|
| Period April | Malware 3,044,582 | Phishing 1,087,217 | Scam 680,624 | All threats 4,806,526 |
| Period May | Malware 2,931,110 | Phishing 694,605 | Scam 655,739 | All threats 4,273,828 |
| Period June | Malware 4,078,389 | Phishing 895,363 | Scam 834,827 | All threats 5,797,163 |
| Period Q2 total | Malware 10,054,081 | Phishing 2,677,185 | Scam 2,171,190 | All threats 14,877,517 |
Data collected from April 1, 2026, to June 30, 2026. All data was processed in accordance with NordVPN’s terms of use opens in a new tab and privacy policy opens in a new tab. Our findings were derived only from aggregated app usage statistics.
Malware
Hiding in plain sight
Malware refers to any kind of programming that was deliberately designed to harm you or your device. This includes malicious software like viruses, trojans, ransomware, and spyware. Malware can steal sensitive data, encrypt important files, or even take over the machine, putting the criminal in complete control.
How phishing attacks lead to malware
Unlike zero-day exploits and bugs, malware is not present on machines from the get-go — it must be actively brought onto your device, such as by downloading an infected file. One of the most common ways to get infected with malware is through phishing attacks. Scammers use deceptive misspellings of popular brands (such as spelling “Amazon” as “Arnazon”) to trick victims into clicking phishing links and downloading infected files.
The brands that scammers impersonate are not at fault — such fakes hurt their reputation as well, forcing companies to actively hunt them down. But high brand awareness can lull victims into a false sense of security and get them to lower their guard.
Most impersonated brands in credential harvesting attacks — Q2 2026
| Brand | Malicious URLs detected |
|---|---|
Microsoft | 4,627 |
Roblox | 3,547 |
1&1 Ionos | 2,419 |
Netflix Inc. | 2,343 |
Amazon.com Inc. | 1,494 |
Data collected from April 1, 2026, to June 30, 2026. NordVPN is not endorsed by, maintained, sponsored by, affiliated or in any way associated with the owners of the mentioned brands. Brands are indicated solely for the purpose of accurately reporting information related to brands that were most likely to be impersonated for spreading malware.
Countries most affected by malware
The risk of running into a malicious domain is not spread evenly across the world. The differences could be attributed to varying levels of internet connectivity, economic development, and cybersecurity awareness between countries. Below are the five countries with the most threat encounters in each region.
Africa — Q2 2026
| Country | Threats blocked |
|---|---|
| Nigeria | 71,478 |
| South Africa | 48,589 |
| Morocco | 25,729 |
| Kenya | 22,249 |
| Ghana | 19,608 |
Data collected from April 1, 2026, to June 30, 2026.
Crypto address checker: Catching the threat before your money leaves
Once you send cryptocurrency, it's gone for good — you can’t call a bank or file a chargeback. But you can be safer with NordVPN's crypto address checker, which screens wallet addresses against known fraud databases before you confirm a transfer.
Risky crypto addresses flagged in Q2 2026
| Period | Suspicious activity | Fraud | Cyber threat | Total flagged |
|---|---|---|---|---|
| Period April | Suspicious activity 472,947 | Fraud 24,350 | Cyber threat 5,465 | Total flagged 502,762 |
| Period May | Suspicious activity 482,567 | Fraud 27,026 | Cyber threat 4,559 | Total flagged 514,152 |
| Period June | Suspicious activity 577,965 | Fraud 34,134 | Cyber threat 4,143 | Total flagged 616,242 |
| Period Q2 total | Suspicious activity 1,533,479 | Fraud 85,510 | Cyber threat 14,167 | Total flagged 1,633,156 |
Data collected from April 1, 2026, to June 30, 2026.
More than a fake website
Detecting phishing and scams
Scam and phishing websites are designed to trick you into giving away your personal information, making payments for products that don’t exist, or simply downloading malware. They work by luring you in through email, social media, or banners, where they promise too-good-to-be-true deals. Once you engage, you may fall victim to identity theft, financial loss, or malware attacks.
The most common online scams
B2B scam
Business-to-business (B2B) scammers pose as legitimate businesses to trick other companies into paying for fake goods or services.
Chargeback recovery fraud
Scammers offer to help individuals recover money lost through chargebacks or other disputes. They demand upfront payments or personal information without providing any actual recovery services.
Crypto fraud
Scammers trick victims into investing in fake or non-existent cryptocurrencies, or steal crypto from digital wallets through phishing attacks or fake initial coin offerings.
Romance fraud
Scammers create dating websites or sign up for real dating services under someone else's name and establish a relationship with victims. They manipulate their victims into sending money and gifts, or gather personal information about them.
Job offer scam
Employment scams involve fake job offers that require victims to pay upfront fees for training, equipment, or background checks. Sometimes fake employers demand that you give them sensitive information to verify your employment or identity.
IT support scam
Scammers impersonate tech support agents, often claiming that a victim's device has a virus or technical issue, and then charge for unnecessary services or gain remote access to steal personal information.
Illegal goods and services fraud
These scammers try to sell illegal goods or services, like counterfeit products, drugs, or hacked accounts. This scam could lead to financial loss as well as to legal consequences for the buyer.
Intellectual property infringement fraud
Scammers pretend to be copyright holders or lawyers and demand payment for alleged intellectual property violations. They often threaten legal action to coerce payment.
Investment fraud
Scammers offer unexpected new investment opportunities and promise high returns with little risk. This scam often leads to significant financial loss and stolen data.
Shopping scam
Scammers set up fake online shops or listings that offer products at very low prices to attract buyers. You either receive fake products, nothing at all, or have your financial information stolen.
Malicious spam
Scammers use mass emails or spam messages to promote fake products, services, or offers, often leading people to phishing sites and involving them in further scams.
Recurring subscription fraud
Victims are tricked into signing up for services or products with hidden recurring fees, which are often difficult to cancel. They often result in unexpected charges or even stolen credit card data.
Avoid phishing and scams with NordVPN’s next-gen antivirus
Spot online scams before they can do any harm — our next-gen antivirus blocks millions of scams every month.
Scam and spam calls: The threats that reach your phone
Not every digital threat arrives through a browser. Scam and spam calls remain one of the most persistent ways scammers reach people directly, and they're one of the hardest to filter by instinct alone. NordVPN's call and message protection feature screened millions of incoming calls over a 25-day sample period, noting each one by its type:
Calls flagged by category
| Category | What it is | Calls flagged | Daily average |
|---|---|---|---|
| Category Telemarketing | What it is Unsolicited sales and promotional calls | Calls flagged 1,029,547 | Daily average 17,751 |
| Category Scam | What it is Calls attempting fraud, impersonation, or theft | Calls flagged 78,606 | Daily average 1,355 |
| Category Finance | What it is Unsolicited calls about loans, debt, or investments | Calls flagged 2,939 | Daily average 51 |
| Category Services | What it is Unsolicited offers for utilities, repairs, and subscriptions | Calls flagged 809 | Daily average 14 |
| Category Fundraising | What it is Donation and charity solicitations | Calls flagged 319 | Daily average 6 |
| Category Total flagged | What it is | Calls flagged 1,112,220 | Daily average 19,176 |
Data collected from May 4, 2026, to June 30, 2026.
Hijacked session alerts: When attackers take over your accounts
You don't always need to hand over a password for someone to get into your account. If you enter your password and two-factor authentication code and then an attacker steals your session cookie, they don’t need to log in again. They can remotely take over your browsing session — no password needed. NordVPN monitors for leaked session cookies tied to your accounts and alerts you so you can log out everywhere and shut the intruder out.
Digital threats blocked in Q2 2026
| Period | Alerts issued |
|---|---|
April | 17,246 |
May | 13,733 |
June | 69,782 |
Q2 total | 100,761 |
Data collected from January 1, 2026, to March 30, 2026. All data was processed in accordance with NordVPN’s terms of use opens in a new tab and privacy policy opens in a new tab. Our findings were derived only from aggregated app usage statistics.
How to stay safe from common cyberthreats
Develop good cybersecurity habits.
Cybercriminals prey on apathy, confusion, and ignorance, hoping that victims will forego due diligence. For example, most phishing attempts involve distorted names of popular brands.
Verify, download, scan, install.
Malware executables may be disguised as or even hidden in legitimate files. Always verify the website you wish to download from, and always use anti-malware tools like NordVPN’s next-gen antivirus to inspect files you download. This includes suspicious email attachments.
Be careful where you go online.
Certain web domain categories are much more likely to compromise your device than others. If you visit websites that are likely to contain malware, pay attention to what you type, click, and download.
Let NordVPN’s next-gen antivirus work so you don’t have to
Avoid scams, phishing attacks, malicious downloads, and intrusive ads and trackers with our next-gen antivirus, which:
Limits phishing, scams, and malicious sites
Detects downloading malware and viruses
Checks crypto wallet addresses
Keeps an eye on hijacked sessions
Stops ads and trackers
Checks your emails
Methodology
All analysis was performed at an aggregated level. It did not involve any information that could be linked to an individual user.
For journalists
Get localized, country-specific infographics and reports about countries you’re most interested in.
Get in touch
If you need additional information regarding this research or want to request an interview, please contact us at press@nordsec.com, and we will get back to you shortly.