2025 TRENDS
Account Takeover
Attack Trends
Uncover exclusive insights from Kasada’s infiltration of 22 credential stuffing groups. Dive into the data, emerging trends, and actionable strategies to safeguard your login endpoints in 2025.
2025 TRENDS
Account Takeover
Attack Trends
Uncover exclusive insights from Kasada’s infiltration of 22 credential stuffing groups. Dive into the data, emerging trends, and actionable strategies to safeguard your login endpoints in 2025.
SEE THE TRENDS
Key Findings
SEE THE TRENDS
Key Findings
250% Increase in Account Takeover
Account takeover attacks grew by 250% in 2024, with notable spikes during high-traffic periods.
1,000+ Brands
Over 1,000 large companies were targeted since January 2024, compromising millions of customer accounts.
55K Accounts Breached in the Last Month
6.2 million accounts were compromised over the past 18 months — 55,000 in just the last month.
Tracking ATO: Monthly Attack Patterns
Kasada observed ATO attacks and fraud spiking in both summer and October, highlighting the seasonality of bot-driven threats. These fluctuations may be driven by attackers with more free time in the summer—such as students experimenting with credential stuffing—and increased fraud activity in October as cybercriminals ramp up for the holiday shopping season, testing stolen credentials and refining their tactics before peak retail periods.
250% Increase in Account Takeover
Account takeover attacks grew by 250% in 2024, with notable spikes during high-traffic periods.
1,000+ Brands Targeted
Over 1,000 large companies were targeted since January 2024, compromising millions of customer accounts.
55K Accounts Breached Last Month
6.2 million accounts were compromised over the past 18 months — 55,000 in just the last month.
Tracking ATO:
Monthly Attack Patterns
Kasada observed ATO attacks spiking in summer months and October, highlighting the seasonality of bot-driven threats. These fluctuations may be driven by attackers with more free time in the summer — such as students experimenting with credential stuffing — and increased fraud activity in October as cybercriminals ramp up for the holiday shopping season, testing stolen credentials and refining their tactics before peak retail periods.
Industry Breakdown: Who’s Being Targeted?
Credential stuffing is a cross-industry threat, but certain sectors are more frequently targeted due to the high value of customer accounts, such as loyalty and rewards points, and the sensitive financial information and personal data they store.
Industry Breakdown:
Who’s Being Targeted?
Who’s Being Targeted?
Credential stuffing is a cross-industry threat, but certain sectors are more frequently targeted due to the high value of customer accounts, such as loyalty and rewards points, and the sensitive financial information and personal data they store.
Traditional Defenses Are Failing
Among targeted and compromised companies, 85% already had a bot detection solution—proving just how aggressive and advanced these attackers have become.
Traditional Defenses Are Failing
Among targeted and compromised companies, 85% already had a bot detection solution—proving just how aggressive and advanced these attackers have become.
How Bots Are Outsmarting Detection
When launching account takeover attacks, threat actors use advanced tools like OpenBullet, which enable large-scale automation with minimal effort. This allows adversaries to configure custom scripts that bypass common defenses, such as CAPTCHA, using techniques like rotating proxies and mimicking human behavior to remain undetected.
How Bots Are Outsmarting Detection
When launching account takeover attacks, threat actors use advanced tools like OpenBullet, which enable large-scale automation with minimal effort. This allows adversaries to configure custom scripts that bypass common defenses, such as CAPTCHA, using techniques like rotating proxies and mimicking human behavior to remain undetected.
SEE THE TRENDS
Uncover how attackers exploit ATO—and how to stop them.
SEE THE TRENDS
Uncover how attackers exploit ATO—
and how to stop them.
