The Inputs to Automated Fraud Got Cheaper in Q3 2026
In Q3 2026, the inputs to automated fraud got cheaper and easier to replace. A cluster of criminal marketplaces collapsed in August, yet listings rose 52% as sellers re-emerged on other platforms within weeks. Identity data exposed in 40+ incidents fed a market where every input to a Know-Your-Customer (KYC) check is for sale. AI lowered the cost of each stage of the abuse, from writing configurations to reverse engineering defenses.
Kasada's Q3 2026 Quarterly Threat Intelligence Report draws on the millions of unique events KasadaIQ collects each day, supported by open and closed course selection and in-house analysis. Below are the four insights that shaped the quarter.
Bottom line
- Removing a criminal marketplace redistributes its stock. Supply grew 52% across the August collapse.
- AI is lowering the cost and raising the speed of existing adversary activity at every stage of the attack chain.
- Identity verification has become a product. A synthetic identity that clears KYC costs under $100.
- The 2026 holiday season will start before Black Friday, and defenders should move peak posture to the week of November 16.
A criminal marketplace takedown moved the stock and grew the market
In early August 2026, a cluster of linked criminal marketplaces stopped operating within a single day. These platforms hosted the storefronts of individual fraud vendors, so the collapse hit an entire tier of the ecosystem at once. In the same window, merchants reported a forced migration that locked or transferred their cryptocurrency, with reported losses of $500K+.
The market absorbed the loss within weeks. KasadaIQ-tracked listings climbed from 69.5K in July to 105.6K in September. Surviving platforms grew 39x over the same period. Half of the displaced sellers were trading on a new platform within 18 days, and 90% within seven weeks.
Across the quarter, KasadaIQ counted 688K+ sales on criminal marketplaces worth $3.2M+, from 3.9K active sellers. Against Q2 2026, sales more than doubled while the seller count fell by about a third.
The commercial refund market has expanded significantly since the RFA Report’s fieldwork in 2023 and 2024. Monthly refund fraud signals on Telegram, the largest single source, grew 3.5x between January and September 2026. September had nearly matched August with ten days still to go.
AI is lowering the cost of every stage of the attack chain
AI played a prominent role across the Q3 attack chain. Stolen AI account sales rose 133% compared to Q2 on just 15% more stock, while the average sold price fell 11%. Access to AI tools is trading as a cheap commodity.
Adversaries are also pointing these tools at defenses. Community discussion of LLMs to reverse engineer anti-bot scripts grew 19x since Q1, and freelancers advertising reverse engineering paired with LLMs grew 7x. OpenBullet 2.0, the automation suite often used for credential stuffing and account checking, released a built-in MCP server that lets an AI agent write and debug attack configurations. Meanwhile, AI crawlers sent 33.7M+ requests across monitored sites in a single month, 86% of them just from Meta and ByteSpider.
KYC identity verification is now a product adversaries can buy
KasadaIQ tracked 40+ identity exposures covering 344M+ records in Q3, alongside 3.5K+ marketplace listings advertising 51M+ records in stock. Every component of a KYC check is on sale, including identity numbers, document scans and selfies. Generated faces and human verification services starting at $40 handle liveness checks. OTP bypass bots sell for $0.25.
Full service stores now package the whole lifecycle. A marketplace KasadaIQ will refer to as Wilting Topiary sells identity products beside cashout services, mule networks and malware, taking a synthetic identity from signup to withdrawal.
The 2026 holiday threat season will start before Black Friday
Adversaries claimed 924K+ checkouts across 710+ brands in communities monitored by KasadaIQ. Collectibles drove 36% of that activity, more than double sneakers and streetwear. Thursday product drops set the weekly peak, accounting for 24% of reported checkouts.
In 2025, the biggest checkout day fell on November 18, nine days before Black Friday. Wider resale margins and AI-written configurations point to an even earlier potential start in 2026. Legitimate AI shopping agents will add to the noise, making automated threats harder to separate from real customers.
Accounts on criminal marketplaces are now priced by what they hold
Listings per brand on criminal marketplaces rose in all 11 industries in KasadaIQ's industry threat models, led by Gaming, Digital Platforms and Streaming & Creator. Sellers now tier and price accounts by their balance, subscription or loyalty points. 61% of the malicious login configurations collected by KasadaIQ were built to appraise the account they break into. Retail & eCommerce, Digital Platforms and QSR & Food Delivery carry the highest threat ratings this quarter.
What defenders should know to stop automated fraud
Treat AI as an adversary capability. Static defenses invite adversaries to reverse engineer them once and reuse the result. Kasada continuously evolves its protections to force adversaries to start again, while KasadaIQ monitors circumvention discussions.
Judge the visitor as well as the document. A passed KYC check no longer proves a genuine user. Extend login-grade protection to signup and account recovery and score automation, device integrity and behavior. Kasada evaluates login and account creation for automation from the initial request via client- and server-side detections. It links bot, device and account signals to uncover coordinated abuse across sessions and devices, regardless of presented identity documents.
Bring peak-season defenses forward to the week of November 16. Monitor limited drops, early access releases and secondary storefronts. Set endpoint agent policies by November 1.
Know where your industry sits, and where you sit within it. Exposure varies widely among peers. KasadaIQ ranks threats across 11 industries and benchmarks organizational exposure.
Download the full Q3 2026 Quarterly Threat Intelligence Report for the full threat landscape, the 2026 prediction tracker and threat breakdowns for all 11 industries. To see how your organization compares to its peers, contact the KasadaIQ team for a tailored assessment.
