Loading story…
DataDome reported that malicious automated traffic increased 124% between July 2025 and June 2026, compared with 13.2% growth in human traffic. Analysis spanning more than one trillion requests across over 75,000 customer sites found that bots and AI agents accounted for roughly 26.5% of traffic. Web scraping represented 70.9% of malicious bot activity and rose 185.2%, driven in part by collection of data for AI-model training; scalping, fake-account creation, and DDoS activity also grew.
AI-agent and LLM-crawler traffic rose 82.3%, while monthly AI-bot activity against login pages increased more than eightfold during the first half of 2026, increasing exposure to credential testing and account abuse. In testing of 21,491 popular websites, 65.3% failed to detect any of 10 simulated bot types and only 2.4% stopped or challenged all of them; telecommunications organizations performed worst. DataDome advised organizations to distinguish authorized AI assistants from malicious automation through behavioral context rather than relying only on individual-request or browser-side indicators.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Between July 2025 and June 2026, DataDome observed malicious automated traffic rise 124%, compared with 13.2% growth in human traffic. Web scraping comprised 70.9% of bad-bot traffic, while AI-agent and LLM-crawler traffic increased 82.3%.
DataDome published its State of Bot & Agent Security Report based on analysis of more than one trillion requests across more than 75,000 customer sites. The report warned that organizations struggle to distinguish legitimate AI automation from malicious activity targeting authentication, transactions, and other workflows.
In a June test, DataDome tested 10 simulated bot types against 21,491 popular websites and found that 65.3% failed to detect any of them; only 2.4% stopped or challenged every bot type. Telecommunications sites were identified as the weakest sector in the testing.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cloudflare's 2025 review highlights a dramatic increase in global internet traffic, with a 19% year-over-year surge largely attributed to the proliferation of bots and AI crawlers. These non-human actors, including search crawlers, AI agents, and malicious automation, now account for approximately 30% of all web traffic, placing unprecedented strain on network infrastructure and security defenses. The surge in AI-driven bot activity has led to data request spikes that can rival Distributed Denial of Service (DDoS) attacks, forcing website owners and service providers to adapt rapidly. Cloudflare's CEO described this trend as a fundamental rewiring of the internet, with AI not only driving traffic but also reshaping the threat landscape. Akamai's analysis corroborates these findings, noting that while AI bot traffic is significant, the larger and more persistent threat comes from evasive scrapers, which generate nearly three times more traffic than AI bots. These scrapers adapt quickly to new controls and continue to probe for valuable content, especially when AI bots are blocked. The rapid expansion of AI use, combined with the growing volume of automated traffic, is creating new challenges for security, resilience, and equitable access to online resources. As AI becomes embedded in everyday applications, the need for robust mitigation strategies and infrastructure upgrades becomes critical to maintaining internet stability and security.
Jun 29, 2026
Cybercriminals are increasingly leveraging advanced AI technologies, including large language models (LLMs) and agentic AI, to automate and scale online fraud, abuse, and credential theft campaigns. These AI-driven attacks enable adversaries to craft convincing phishing emails, create fake websites, and even execute deepfake voice or video calls, making it more difficult for organizations to detect and defend against malicious activity. The rise of agentic AI, which can autonomously gather inputs, evaluate options, and take actions such as infiltrating networks and stealing credentials, marks a significant escalation in attacker sophistication and persistence. Recent research highlights a 300% increase in AI-powered bot traffic, complicating the application and API threat landscape and lowering the barrier to entry for cybercriminals through fraud-as-a-service (FaaS) offerings. These developments have led to a surge in digital fraud and abuse, impacting key industries and regions globally. Organizations are advised to adopt AI-driven defenses and maintain regulatory compliance to counteract the growing threat posed by malicious AI bots and automated credential theft campaigns.
Jun 29, 2026
Automated bot farms have become a central tool in modern information warfare, leveraging artificial intelligence to manipulate public opinion, influence elections, and erode trust in institutions. According to Thales, automated bot traffic accounted for 51% of all web traffic in 2024, marking the first time in a decade that bots have surpassed human activity online. These bots, often state-sponsored by countries such as Russia, China, and Iran, use sophisticated techniques to mimic human behavior, making them increasingly difficult to detect. AI-driven bots can generate content at a scale and speed unattainable by humans, flooding online platforms with misinformation and pushing authentic conversations to the margins. By creating the illusion of consensus, these bots can make fringe viewpoints appear mainstream, amplifying divisive narratives and undermining democratic debate. The phenomenon known as the 'liars dividend' emerges as people begin to distrust all online content, knowing that fakes and bots are pervasive. In one notable case, 45 bot-like accounts on X posted over 440,000 times before a UK election, reaching more than 3 billion views, and continued their activity after the vote. Experiments have shown that even when users are asked to identify bots, they are often unsuccessful, with a 58% error rate observed in political discussions on Mastodon. The evolution of bots is further accelerated by AI, which enables them to mimic human actions such as typing, scrolling, and pausing, making detection even more challenging for security teams. Generative AI tools have lowered the barrier to entry for attackers, allowing even those with limited technical skills to launch large-scale credential stuffing campaigns, scrape websites, or orchestrate scams. The scale and sophistication of these operations mean that both brute-force and stealth attacks are on the rise, with bots capable of blending seamlessly into normal traffic. The impact of these campaigns is global, with Russia leading efforts to weaken democratic processes in the US and Europe through targeted disinformation. As bots become more prevalent and harder to distinguish from real users, the challenge for cybersecurity professionals intensifies, requiring new strategies and technologies to detect and mitigate automated threats. The growing reliance on AI in bot operations signals a paradigm shift in the threat landscape, demanding heightened vigilance and adaptive defenses from organizations and governments alike. The erosion of trust in digital information poses a significant risk to democratic institutions and public discourse, making the fight against AI-driven disinformation a top priority for the cybersecurity community. The combination of technical sophistication, global reach, and psychological impact underscores the urgent need for comprehensive countermeasures. As the arms race between bot operators and defenders escalates, the future of online trust and security hangs in the balance.
Jun 29, 2026