Discover Q3 2025’s top bot attack trends like AI-driven attacks, account takeover, and fraud tactics - with insights from Kasada’s threat intelligence team.
Q3 2025 — AFR Edition
Automation isn't slowing down. Bots continue to scale faster than defenses, reshaping how fraud, resale, and credential theft occur online.
16%
increase in account sales since Q2, demonstrating the rising profitability of account takeover (ATO).
$275k
a month was earned by a single reseller group, proving that botting isn't just a hobby, it's an organized business.
58%
of all events were "basic attacks," yet their scale and speed still overwhelm traditional defenses.
Traditional defenses can't keep up. Kasada's analysts tracked a surge of automation driven by AI, proxy networks, and human ingenuity, revealing just how adaptable today's adversaries have become.
Kasada found marketplaces selling accounts tied to gun retailers and background-check services. With sales up 16% in Q3, ATO is shifting from mass theft to targeted, high-value attacks.
As more businesses adopt scarcity tactics for sales and product drops, they inevitably attract aggressive resellers. The consequences of online reselling are strategic, hurting businesses long after the initial transaction.
Attackers now use AI to analyze data and automate phishing and credential theft. It's rewriting the rules, forcing defenders to rethink how they detect and respond.
Kasada IQ Analyst
In Q3, adversaries continued to show a clear preference for proven methods. The infostealer ecosystem remains resilient, with infrastructure disruptions proving only temporary setbacks for well-established operations. The continued proliferation of infostealers highlights that credentials remain a highly profitable and accessible target for cybercriminals.
Kasada IQ Analyst
Proxy and hosting providers now enable threat actors through deceptive business tactics that keep them online after takedowns. Their resilience underscores why defenders need to go beyond defensive monitoring and engage in proactive, bespoke defenses.
Kasada IQ Analyst
In Q3, adversaries continued to show a clear preference for proven methods. The infostealer ecosystem remains resilient, with infrastructure disruptions proving only temporary setbacks for well-established operations. The continued proliferation of infostealers highlights that credentials remain a highly profitable and accessible target for cybercriminals.
Kasada IQ Analyst
Proxy and hosting providers now enable threat actors through deceptive business tactics that keep them online after takedowns. Their resilience underscores why defenders need to go beyond defensive monitoring and engage in proactive, bespoke defenses.
Kasada IQ Analyst
In Q3, adversaries continued to show a clear preference for proven methods. The infostealer ecosystem remains resilient, with infrastructure disruptions proving only temporary setbacks for well-established operations. The continued proliferation of infostealers highlights that credentials remain a highly profitable and accessible target for cybercriminals.
Before Kasada, each organization in the study had a legacy CDN bot management solution. All of them had the same problem: their tool was telling them they were protected. They weren’t.
New Forrester research reveals how bots, scrapers, and AI agents distort attribution, waste ad spend, and create blind spots across teams — and outlines how to align marketing and security around what actually drives revenue.
