Bots Now Form Over Half of Global Internet Traffic in 2025, Driving API Attacks and Business Metric Distortion
Bots already account for the majority of internet traffic, creating challenges that extend far beyond traditional information security. In 2025, automated clients generated more than 50% of observed traffic, with malicious bots responsible for 40% of the total. The number of attacks leveraging AI-enabled automation grew 12.5 times compared with the previous year.
During the 81st anniversary of Victory Day, Garda WAF blocked over 3.5 million attacks and stopped more than 307,000 bot requests targeting the Immortal Regiment historical movement site. Industry reports vary because vendors analyze different networks and apply different counting methods, yet the consistent message is that human-generated requests can no longer be assumed by default.
Shift of automated traffic from web pages to APIs
Modern bots increasingly target APIs directly instead of emulating browsers. Akamai data shows a 113% rise in daily API attacks, with 87% of organizations reporting at least one API-related security incident. The share of attacks involving unauthorized business workflows grew from 30% to 61%.
At the same time, simple automated scripts remain dominant. Qrator Labs statistics for Q2 2025 indicate that basic bots generated 59% of protected bot traffic while API bots accounted for 38%. A single large botnet observed by the company contained more than 4.5 million devices, twenty times larger than the biggest network detected the previous year.
New categories of crawlers and agents
Cloudflare Radar data reveals that 40% of verified bot traffic came from search crawlers, 20% from AI crawlers, and 13% from SEO bots. The boundary between beneficial and harmful automation has blurred because AI agents can generate high load, consume content without returning visitors, or perform reconnaissance under the guise of legitimate use.
OWASP classifies automated abuse of legitimate application functions as automated threats. Common scenarios include credential stuffing, scraping of pricing and inventory data, gift-card enumeration, ticket hoarding, and market manipulation through fake reviews or demand signals.
Impact on business metrics and infrastructure
Bot traffic distorts web analytics by inflating session counts and lowering observed conversion rates. An example shows that 5,000 additional bot sessions can reduce measured conversion from 3% to 2% without any change in real customer behavior. Infrastructure resources are consumed for CDN traffic, database queries, and third-party service limits, while aggressive protection mechanisms such as repeated CAPTCHAs can degrade genuine user experience.
Detection now relies on combinations of signals rather than single indicators. JA3/JA4 TLS fingerprints, header ordering, JavaScript execution integrity, and behavioral patterns within sessions help distinguish automated clients even when they use real browser engines such as Chromium, Playwright, or Puppeteer.
Related articles
Octagon Android RAT Poses as Bahrain Emergency Alert App to Steal Credentials and Establish Persistent Surveillance
A remote access trojan named Octagon targets Android devices by masquerading as the official emergency alerts application from Bahrain. The infection begins when victims download the BH-Alert.apk file from phishing websites. The malware guides users through seven steps to grant dangerous permissions while using encrypted code hidden inside a font file extension to evade static analysis. It installs a secondary component called OctagonPanel and deploys mutual-monitoring surveillance services that restart each other if terminated. Additional persistence is achieved through boot receivers, a fake Android account, and scheduled synchronization tasks every 30 minutes. The trojan abuses the Accessibility Service to record unlock patterns, PINs, and passwords while also harvesting SMS messages, contacts, call logs, and screenshots. A criminal-controlled VPN allows interception and redirection of victim traffic.
Distributed Crawler Poses as Human Visitor to Evade Analytics and Ad Filters
A detailed investigation revealed a sophisticated distributed crawler that successfully mimicked legitimate human browsing behavior across multiple unrelated websites. The crawler generated realistic events in Google Analytics while avoiding ad script loading and resource chains that would confirm genuine user sessions. Server logs showed consistent patterns of fake search engine referrers, internal navigation with fabricated Referer headers, and selective requests limited mostly to images returning 404 errors. Analysts built a graph-based detection system that correlated events across sites to expose the coordinated activity despite individual requests appearing benign. The campaign rotated browser signatures and IP addresses frequently, making single-site rate limiting ineffective. The case demonstrates how modern crawlers can exploit Measurement Protocol and incomplete bot detection to consume server resources without contributing to revenue.
Comprehensive Collection of Malware Analysis and Development Books Released for Security Researchers
A detailed roundup of professional literature covering malware development, reverse engineering, and defensive analysis has been published. The selection includes resources focused on Windows, macOS, and Android platforms. Key titles address practical techniques for building and dissecting malicious software, evasion methods, and forensic investigation. Books such as MalDev Academy and Practical Malware Analysis provide hands-on training with real-world samples and laboratory exercises. Additional volumes explore macOS-specific threats and Android malware detection using machine learning. The compilation aims to support both red team practitioners and malware analysts in deepening their technical expertise.
Astaroth Trojan Hijacks WhatsApp Web Sessions to Spread Banking Malware to Contacts
The operators of the Astaroth banking Trojan, also known as Guildma, have added a new module that turns infected Windows systems into automated spam bots for WhatsApp Web. The malware copies browser profiles from Chrome or Edge, launches a legitimate WebDriver instance, and connects to an already authenticated WhatsApp Web session using the WPPConnect/WA-JS library. Once active, the bot scans the victim's contact list and sends each recipient a personalized greeting, a ZIP archive containing the Astaroth loader, and a closing message, all generated with randomized phrasing to evade detection. The technique leverages the trust users place in messages from known contacts, significantly increasing the likelihood of successful infection. Researchers at CrowdStrike note code similarities with tools used by other Latin American groups, including Vareg, suggesting shared development or active exchange of components. Indicators of compromise include PowerShell downloads of WebDriver, creation of ChromeAuto_ folders in C:\Users\Public\Temp, headless Chromium execution, and network activity tied to WPPConnect components.