A New Phase of Automated Threats
daily increase in paid AI account demand
stolen accounts traded in Q1 2026
revenue generated in USD from account sales
AI Has Become Core to Modern Threat Operations
AI is no longer a supporting tool for attackers.
It is now embedded across the full lifecycle of automated threats — from development to execution to monetization.
What was previously experimental is now operational.
AI Has Become Core to Modern Threat Operations
AI is no longer a supporting tool for attackers.
It is now embedded across the full lifecycle of automated threats — from development to execution to monetization.
What was previously experimental is now operational.
AI Adoption Has Scaled Rapidly
AI is now a standard component of attacker toolkits, with demand for paid AI accounts rising from 6 per day to 3,845 in Q1 — a 640x increase as adversaries move from experimentation to operation.
Automation Is Easier to Access
KasadaIQ observed a 248% year-on-year increase in AI-related job ads in adversary communities. No-code tools are lowering the barrier to entry, enabling automated attacks at scale.
Coordinated Attack Operations
At scale, attacks are coordinated: 3.4M+ bot checkouts across 122+ brands show operations spanning products, platforms, and markets, and executed with increasing efficiency.
AI Adoption Has Scaled Rapidly
AI is now a standard component of attacker toolkits, with demand for paid AI accounts rising from 6 per day to 3,845 in Q1 — a 640x increase as adversaries move from experimentation to operation.
Automation Is Easier to Access
KasadaIQ observed a 248% year-on-year increase in AI-related job ads in adversary communities. No-code tools are lowering the barrier to entry, enabling automated attacks at scale.
Coordinated Attack Operations
At scale, attacks are coordinated: 3.4M+ bot checkouts across 122+ brands show operations spanning products, platforms, and markets, and executed with increasing efficiency.
From our analysts:
2026 predictions
Adversarial AI will become widely deployed—
continuously testing platform defenses, exploiting weaknesses, and sharing evasion intelligence in real time.
Kasada IQ Analyst
Experimentation with fully decentralized architectures
will begin: smart contract escrow, IPFS hosting,
blockchain reputation systems.
Kasada IQ Analyst
About the Data
KasadaIQ provides an inside view into the adversary ecosystem — analyzing millions of automated interactions each quarter across 2,000+ collection points and 23M+ messages from open and closed sources. This intelligence informs our defenses and helps enterprises stay ahead of evolving threats.
More reports from Kasada
Stay ahead of bots
Get access to our monthly intel brief with fresh data, attack trends, and analysis.
