Discover Q3 2025’s top bot attack trends like AI-driven attacks, account takeover, and fraud tactics - with insights from Kasada’s threat intelligence team.
Q3 2025
Automation isn't slowing down. Bots continue to scale faster than defenses, reshaping how fraud, resale, and credential theft occur online.
16%
increase in account sales since Q2, demonstrating the rising profitability of account takeover (ATO).
$275k
a month was earned by a single reseller group, proving that botting isn't just a hobby, it's an organized business.
58%
of all events were "basic attacks," yet their scale and speed still overwhelm traditional defenses.
Traditional defenses can't keep up. Kasada's analysts tracked a surge of automation driven by AI, proxy networks, and human ingenuity, revealing just how adaptable today's adversaries have become.
Kasada found marketplaces selling accounts tied to gun retailers and background-check services. With sales up 16% in Q3, ATO is shifting from mass theft to targeted, high-value attacks.
As more businesses adopt scarcity tactics for sales and product drops, they inevitably attract aggressive resellers. The consequences of online reselling are strategic, hurting businesses long after the initial transaction.
Kasada IQ Analyst
In Q3, adversaries continued to show a clear preference for proven methods. The infostealer ecosystem remains resilient, with infrastructure disruptions proving only temporary setbacks for well-established operations. The continued proliferation of infostealers highlights that credentials remain a highly profitable and accessible target for cybercriminals.
Kasada IQ Analyst
Proxy and hosting providers now enable threat actors through deceptive business tactics that keep them online after takedowns. Their resilience underscores why defenders need to go beyond defensive monitoring and engage in proactive, bespoke defenses.
Kasada IQ Analyst
In Q3, adversaries continued to show a clear preference for proven methods. The infostealer ecosystem remains resilient, with infrastructure disruptions proving only temporary setbacks for well-established operations. The continued proliferation of infostealers highlights that credentials remain a highly profitable and accessible target for cybercriminals.
Kasada IQ Analyst
Proxy and hosting providers now enable threat actors through deceptive business tactics that keep them online after takedowns. Their resilience underscores why defenders need to go beyond defensive monitoring and engage in proactive, bespoke defenses.
Kasada IQ Analyst
In Q3, adversaries continued to show a clear preference for proven methods. The infostealer ecosystem remains resilient, with infrastructure disruptions proving only temporary setbacks for well-established operations. The continued proliferation of infostealers highlights that credentials remain a highly profitable and accessible target for cybercriminals.
Explore the Q2 2026 threat intelligence landscape: AI-accelerated fraud, credential markets, and adversary economics — and how our 2026 predictions are tracking
Explore the Q2 2026 threat intelligence landscape: AI-accelerated fraud, credential markets, and adversary economics — and how our 2026 predictions are tracking
Attackers now use AI to analyze data and automate phishing and credential theft. It's rewriting the rules, forcing defenders to rethink how they detect and respond.
