Adversaries plan holiday bot attacks around the retail calendar, and they start early. In 2025, the biggest sale day for bot checkouts was November 18, nine days before Black Friday. KasadaIQ’s Q3 2026 Quarterly Threat Intelligence Report shows the conditions for an even earlier and faster season this year, with cheaper adversary tooling, more identity data in circulation and resale margins widening into peak.
Bottom line
- Adversaries will repeat the calendar-led rhythm of 2025, with the highest threat week falling between November 16 and 23.
- AI is making it faster and easier for adversaries to build and adapt their attack tooling ahead of the season.
- Refund fraud will extend the season’s losses into January.
- The run-in decides the season. Defenses raised on Black Friday will miss the drops that matter.
The 2026 holiday threat calendar
KasadaIQ expects four windows of adversary activity this season, from the October run-in to the second peak after Christmas.
Last year’s busiest bot day came nine days before Black Friday
KasadaIQ’s 2025 holiday analysis recorded 1M+ bot checkouts. The peak day, November 18, carried about 11% of them compared to about 3.5% on Black Friday. Malicious configurations rose 11.8% year-on-year, surging in the week before Thanksgiving, and stolen accounts earned adversaries $17.2M. About 30% of sold accounts carried loyalty points, the main way adversaries cashed out.
AI is making it faster and easier for adversaries
Malicious configurations encode a target’s login or checkout flow so a bot can run it at scale. Configuration tooling is now wired directly into AI coding assistants. The pre-Thanksgiving configuration surge may start earlier this year, refresh faster and cover more brands than in 2025.
Bots are following hype into every category
In Q3, adversaries reported 924K+ checkouts across 710+ brands. Collectibles accounted for 36%, more than double sneakers and streetwear. Bots also chased limited releases from video game developers, artist merch stores and movie ticket releases, and Thursday drops set the weekly peak. Rising device prices and retail price cuts are widening resale margins into peak, so any brand running a limited drop is in scope.
Stolen identities now reach holiday credit and loyalty accounts
A growing volume of identity documents and personal data is in circulation in 2026. It feeds synthetic account openings at retailers running holiday credit offers, identity-verified recovery of loyalty accounts, and the aged accounts that supply refund fraud.
Refund fraud is the season’s trailing edge
Refund claims trail purchases by three to six weeks, so Black Friday orders become claims from mid-December to mid-January. KasadaIQ tracked a 3.5x rise in monthly refund fraud signals between January and September 2026. Refund fraud is now a service anyone can hire, with 20+ named services across 16 platforms and a full toolkit costing under $12. For the full analysis, see: Refunds for Hire: KasadaIQ Insights on the 2026 Refund Fraud Economy.
Agent traffic will look like bot traffic
Salesforce predicts that 20% of 2026 holiday eCommerce traffic will come from AI agents, and that one in three eCommerce sites will run its own shopper agent by Cyber Week. Agent sessions will run alongside bots on sale days. Without a clear policy, fraud, support and platform teams will read the same traffic in different ways.
A 2026 holiday threat model
Put together, the season moves across the customer journey, from signup in October to returns in January.
What to do before the peak week
- Set an agent policy at endpoint. Leave browsing and search open, gate account pages and checkout to agents acting for a signed-in customer, and close verification flows to everything else.
- Treat November 16 to 23 and December 24 to 27 as the two account takeover peaks. Raise protection on login and recovery, and stage points and stored value freezes.
- Start heightened checkout monitoring in mid-November. Cover loyalty and early access drops, public sale pages and secondary storefronts, which often carry lighter defenses.
- Prepare to inspect high-risk returns. Use device and bot signals from the original checkout to route risky returns to inspection while low-risk returns stay fast.
Kasada secures checkout, login and signup, while KasadaIQ tracks configuration releases and account stock as adversaries prepare for sale days. Download the full Q3 2026 Quarterly Threat Intelligence Report for the full holiday outlook, or contact the KasadaIQ team to review your peak season exposure.
