Q2 2026 Threat Report: Same Adversaries, Faster Tooling
The Q2 2026 Quarterly Threat Report from KasadaIQ tracked 27 predictions through the quarter. Nine moved, none were refuted, and the movement clustered exactly where an accelerating market would put it: AI adoption, credential markets and the economics of bot operations. The predictions that advanced describe a market getting cheaper and faster to enter, not one changing its fundamental character.
That is the finding that ties the whole quarter together. AI is changing how adversaries work, not who they are or why they do it. In every section of the report, the same population of adversaries kept doing familiar work with better tooling.
The economics make the case directly. A newcomer can become fully operational in the bot ecosystem for $400 to $500, roughly 94% of the operators KasadaIQ can classify rent their capability rather than build it, and clean residential proxies now sell from $0.30 per gigabyte, which means IP reputation no longer separates malicious traffic from legitimate. In one public demonstration this quarter, an AI model defeated a commercial licensing system in under five hours for $3.88 in API credits. The barrier to entry is now financial far more than technical.
The criminal account market shows the same theme from a different angle. KasadaIQ tracked 6,076 active sellers against 6,189 the previous quarter, with 97.6% carrying over, so the population held steady even as observed sales volume fell. The market did not shrink; it concentrated on thinner, higher-value inventory, and average prices rose across most industries. The tooling tracked that shift. Among roughly 77 malicious configurations analyzed this quarter, the most complex one captured 24 distinct account fields on login, appraising an account's resale value rather than simply confirming access.
Criminal marketplace activity for legitimate AI accounts told a parallel story. What looked like a spike last quarter has consolidated into a steady, high-volume market, with more than 14,000 AI account sales in Q2, close to 94% of them ChatGPT products, priced from $7 to $60 depending on access and duration.
Even the FIFA World Cup fit the pattern. Fraud tracked the official ticketing calendar rather than the match schedule, with inventory staying dormant until each on-sale opened and established operators redirecting standing tradecraft toward the tournament. The event served as a lure for existing fraud rather than a source of new fraud.
Underneath all of it is a human decision, which is where the report closes. The Spotlight applies a 70-year body of fraud research to the operators behind the tooling and finds that their motivation and rationalization have barely moved, even as AI reshapes their capability.
The report covers each of these in depth. The through line for defenders is that calibrating to this quarter's tooling means missing next quarter's. The durable signal is the motivation and rationalization that do not change.
Download the report: Access the report
