Gen's Q4 Threat Report: The $7M Crypto Scam & 152% Fake Tutorial Surge

The core thesis is clear: scams are the dominant, profit-driven business model for cybercrime. They are not a sideshow; they are the main event. And this is creating a massive, urgent opportunity for security providers.

The scale is staggering. In Q4 2025, a single deepfake crypto scam netted attackers $7 million. That's not a typo. That's a heist executed through social media manipulation, targeting people's trust and their wallets. This is the new frontier of digital crime-profitable, scalable, and increasingly sophisticated.

The evolution is rapid-fire. Fake tutorial scams, where scammers pose as helpful YouTube guides, surged 152% year-over-year. These aren't just annoying pop-ups; they're psychological traps disguised as helpful content, designed to trick users into giving up money or access. The attackers are automating persuasion and scaling across platforms with ease.

And dominance is the defining trend. Scams made up 86% of all attacks blocked in Q4 2025. That's the overwhelming majority. They are the primary vector, the first click that leads to everything else-from malware to data theft. The attackers have mastered the art of blending into everyday digital routines, making their scams feel indistinguishable from ordinary ads or posts until it's too late.

The bottom line is that this isn't just a security problem; it's a booming industry. The $7 million crypto scam and the 152% surge in fake tutorials are not anomalies. They are symptoms of a system where social engineering is the most effective, highest-return attack strategy. For security companies, this is a massive, growing market. The signal is loud: the future of cyber defense is not just about blocking code, but about stopping human manipulation at scale.

Platform Breakdown: Facebook & YouTube Are Scam Havens

The scam economy isn't just persistent-it's built to last. Its resilience comes from a simple, brutal truth: attackers use the platforms people already trust and use every day. This isn't a bug; it's the core business model.

The mechanics are straightforward and devastating. Fake shops are the engine. They accounted for 65% of all social media threats blocked last quarter. That's the overwhelming majority of the digital danger zone. And where do these scams concentrate? Facebook (56%) and YouTube (24%) are the primary launchpads. The attackers aren't hacking the platforms; they're weaponizing them. They blend fake ads and posts into your feed, making scams feel like ordinary shopping or helpful content.

Then there's the delivery system. Malvertising is the primary delivery mechanism. It made up 41% of all attacks blocked in Q4. These are fake ads that serve as the first click, leading directly to scams, malware, or phishing. The scale is massive-41 scams blocked every second, on average, in 2025. This vector is so effective it's now a core part of the attack surface.

The attack surface is now continuous. Scams don't wait for you to open an email. They live in the everyday actions you take: clicking a link, scanning a QR code, approving a device pairing. As Gen's CTO noted, "scams did not announce themselves as threats. They blended into everyday digital routines." This is the ultimate vulnerability. When the scam feels like a normal ad or video, the defenses fail.

The bottom line is that this creates a high-margin, low-friction problem. The platforms are vast, automated, and profitable for the attackers. For security firms, the challenge is clear: you're not just fighting code; you're fighting human behavior at scale, on the very platforms where people spend their time. This setup ensures scams will remain a dominant, persistent threat.

Signal vs Noise: Separating the Real Threat from the Hype

The data is overwhelming, but not all signals are created equal. For investors, the key is cutting through the panic to identify the truly material, persistent trends versus seasonal spikes and one-off noise.

First, the seasonal surge. The 271% jump in e-shop scams during the NZ holiday season is a classic seasonal spike. It's driven by predictable consumer behavior-more online shopping, more time spent on social feeds. This is a temporary pressure point, not a new permanent trend. The real story is what happens when the holiday rush ends. The underlying attack vector remains active.

Then there's the structural vector. The 41% share of malvertising as the top cyberthreat is not a seasonal blip. It's a persistent, high-volume delivery channel. This is the engine that fuels the scam economy, serving as the first click that leads to 86% of all attacks. This is a structural problem with a massive, ongoing attack surface. The fact that malvertising attacks in NZ grew 51% in Q4 compared to a 10% increase in Q3 shows this channel is accelerating, not fading.

Finally, the new high-value front. The focus is shifting to "money tools" and financial wellness apps. These are the new, high-value attack surfaces for identity theft. Why? Because they hold the keys to your financial life. When scammers target these apps, they're going after the ultimate prize: your money and credentials. This represents a clear evolution in attacker strategy, moving from broad-based scams to precision targeting of high-trust financial interfaces.

The bottom line for investors: Ignore the holiday hype. Focus on the 41% malvertising structural vector and the strategic pivot to financial apps. These are the durable, high-margin problems that security providers must solve. That's where the real alpha leak is.

The Alpha Leak: What This Means for Gen's Portfolio

The data isn't just a threat report; it's a revenue blueprint. For Gen, the persistent, high-volume scam economy is a direct, high-margin tailwind for its entire portfolio. The setup is perfect: attackers are scaling their operations, and Gen's brands are positioned to monetize the resulting demand.

First, the core security engine. The fact that scams made up 86% of all attacks blocked in Q4 creates a massive, recurring revenue stream for Norton, Avast, and their peers. This isn't a one-time spike; it's the dominant business model for cybercrime. As attackers rely on automated persuasion and scale across platforms, the need for robust, always-on protection grows. This drives subscription renewals and upgrades, fueling predictable, high-margin income for the core security franchises.

Second, the identity theft pivot is a direct driver for LifeLock. The report highlights that scams are increasingly designed to steal money and credentials. When attackers target financial wellness apps and "money tools," they're going after the ultimate prize: your personal data. This creates a clear, urgent demand for Gen's identity protection services. The more sophisticated the scam, the more valuable a service like LifeLock becomes. It's a natural cross-sell opportunity embedded in the threat landscape itself.

Finally, the attack surface expansion into financial apps like MoneyLion presents a dual-edged sword-and a major alpha leak. On one side, it's a risk to users, potentially damaging brand trust and increasing support costs. On the other, it's a massive, untapped market for Gen's own financial wellness products. The same users being targeted by scammers are the exact audience for tools that help them manage money, build credit, and protect their financial health. This creates a powerful cross-sell funnel: stop the scam, then offer the solution.

The bottom line is that Gen's portfolio is uniquely aligned with the new threat reality. The scam economy is booming, and Gen's brands are the primary defense. This isn't just about blocking attacks; it's about capturing the recurring revenue and strategic positioning that comes with being the essential partner in a world where human trust is the most valuable currency. Watch for how aggressively Gen pushes cross-sells from its security brands into its financial wellness suite. That's where the next wave of growth is being built.

Watchlist & Catalysts: The AI Frontier and Regulatory Shifts

The scam economy is about to get a serious upgrade. The next major catalyst isn't a new platform or a seasonal spike-it's the adoption of AI tools by attackers. The report explicitly flags OpenAI's Operator as the "next frontier," capable of automating daily online tasks. If scammers weaponize these agents, the attack surface explodes. Imagine AI bots placing fake orders, paying invoices to fake vendors, or approving malicious device pairings-all at scale and with human-like precision. This is the next evolution in automated persuasion, moving beyond fake videos to fake actions. The signal is clear: security firms must now defend against AI agents, not just AI content.

The counter-catalyst is Gen's own AI-powered defense. The effectiveness of new security features against these evolving social engineering tactics will be a key metric. Watch for evidence that Gen's brands are successfully blocking AI-assisted scams. This isn't just about stopping code; it's about detecting the subtle, human-like patterns of AI-driven manipulation. Success here validates Gen's R&D spend and strengthens its premium pricing power. Failure would be a major red flag, showing the company is lagging in the arms race.

Regulatory pressure is another looming catalyst. As scams thrive on platforms like Facebook and YouTube, expect increased scrutiny. The report shows these platforms are the primary launchpads, so regulatory shifts aimed at curbing scam ads could disrupt attacker workflows. This might force scammers to shift vectors or increase costs, potentially creating a temporary headwind for the scam economy. However, the core demand for security will remain-attackers will adapt, not disappear. The real test for Gen will be whether its products can seamlessly defend against these shifted tactics.

The bottom line for investors: The AI frontier is the biggest near-term catalyst. It's a double-edged sword for Gen-potentially a massive new revenue driver if its AI defenses work, or a costly race to catch up if they don't. Watch the quarterly threat reports for the first signs of AI-assisted attacks and Gen's response. Also monitor regulatory news in the US and EU for any moves targeting social media ad platforms. These are the signals that will determine whether the scam economy's growth story accelerates or faces a new, costly friction.