New Zealanders are being increasingly exposed to online fraud spread through ads, feeds and videos, a new report finds.

The recently released Gen Q4 Threat Report reveals that cybercrime now relies on ordinary digital actions, occurring across browsers, social feeds, messaging and money apps, rather than sophisticated exploits. More than half of the attacks succeeded when Kiwis completed the final step themselves, whether it’s clicking a link, scanning a QR code, approving a device pairing, or entering a verification code.

The surge in such scammers’ activities appeared during the holiday season, when people spend most of their time online. E-shop scams increased by 271 per cent, with an 82 per cent rise in scam-yourself and remote access trojan (RAT) attacks.

Fake online shops also dominated globally during the season, with over 45 million attacks blocked in Q4 – more than half of the total for last year and a 62 per cent increase from the same period in 2024. Most of the acts, notably phishing, spread more broadly across social media platforms, led by Facebook and YouTube. Gen also warned of dangerous deepfakes, including blocked AI scam videos and manipulated media content.

“Increasingly throughout 2025, scams did not announce themselves as threats. They blended into everyday digital routines,” said Siggi Stefnisson, cyber safety CTO at Gen. 

“Attackers leaned on familiar platforms, trusted interfaces, and automated persuasion, then scaled those tactics across devices and channels.”

Malvertising and the threat of Kiwi DIY culture

Malvertising – fake advertisements – in New Zealand increased by 51 per cent in Q4, compared with a 10 per cent increase in Q3, and was the top cyberthreat to individuals over the last year, accounting for 41 per cent of all attacks worldwide. Most consumers reportedly struggle to distinguish between scam delivery and ordinary ads until money, credentials, or remote access are requested.

Gen telemetry also marked an uptick in fake tutorial scams, which sharply surged by 152 per cent, as Kiwis followed YouTube tutorials and step-by-step guides on external sites to install malware that’s disguised as a helpful tool. Detections of fake computer and mobile scans also rose by 57 per cent.

“Kiwis are known for their ‘No 8 wire mentality’ and it seems that scammers have stumbled upon it,” said Mark Gorrie, VP Apac for Norton. “Unfortunately, this means that New Zealanders will need to be vigilant with DIY videos or guides that direct them to download or install anything – for the foreseeable future.”

As 2025 ended, Gen’s Q4 data saw online fraud “moving back and forth” between devices and platforms. It highlights how modern scams, which began with small, familiar actions performed under time pressure, have crossed device boundaries to scale quickly and remain invisible.