Skip to Content Facebook Feature Image

Artificial Intelligence Fuels Rise of Hard-to-Detect Bots That Now Make up More Than Half of Global Internet Traffic, According to the 2025 Imperva Bad Bot Report

News

Artificial Intelligence Fuels Rise of Hard-to-Detect Bots That Now Make up More Than Half of Global Internet Traffic, According to the 2025 Imperva Bad Bot Report
News

News

Artificial Intelligence Fuels Rise of Hard-to-Detect Bots That Now Make up More Than Half of Global Internet Traffic, According to the 2025 Imperva Bad Bot Report

2025-04-15 15:00 Last Updated At:15:11

MEUDON, France--(BUSINESS WIRE)--Apr 15, 2025--

Thales, the leading global technology and security provider, today announced the release of the2025 Imperva Bad Bot Report, a global analysis of automated bot traffic across the internet. This year’s report, the 12 th annual research study, reveals that generative artificial intelligence (AI) is revolutionizing the development of bots, allowing less sophisticated actors to launch a higher volume of bot attacks with increased frequency. Today’s attackers are also leveraging AI to scrutinize their unsuccessful attempts and refine techniques to evade security measures with heightened efficiency, amidst a growing Bots-As-A-Service (BaaS) ecosystem of commercialized bot services.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20250415432215/en/

Automated bot traffic surpassed human-generated traffic for the first time in a decade, constituting 51% of all web traffic in 2024. This shift is largely attributed to the rise of AI and Large Language Models (LLMs), which have simplified the creation and scaling of bots for malicious purposes. As AI tools become more accessible, cyber criminals are increasingly leveraging these technologies to create and deploy malicious bots which now account for 37% of all internet traffic – a significant increase from 32% in 2023. This is the sixth consecutive year of growth in bad bot activity, posing security challenges for organizations striving to safeguard their digital assets.

Both the Travel and the Retail sectors face an advanced bot problem, with bad bots making up 41% and 59% of their traffic respectively. In 2024, the travel industry became the most attacked sector, accounting for 27% of all bot attacks, up from 21% in 2023. The most notable shift in 2024 is the decline in advanced bot attacks targeting the travel industry (41%, down from 61% in 2023) and the sharp increase in simple bot attacks (52%, up from 34%). This shift indicates that AI-powered automation tools have lowered the barriers to entry for attackers, allowing less sophisticated actors to initiate more basic bot attacks. Rather than relying exclusively on sophisticated techniques, cybercriminals are increasingly utilizing high volumes of simpler bots to inundate travel sites, resulting in more frequent and widespread attacks.

The Rise of AI-Driven Bots: A New Era of Cybersecurity Challenges

The emergence of advanced AI tools, including ChatGPT, ByteSpider Bot, ClaudeBot, Google Gemini, Perplexity AI, and Cohere AI, are transforming not just user interactions but also the methods by which attackers execute cyber threats. According to the Imperva Threat Research team, widely used AI tools are being leveraged for cyberattacks, with ByteSpider Bot alone responsible for 54% of all AI-enabled attacks. Other significant contributors include AppleBot at 26%, ClaudeBot at 13%, and ChatGPT User Bot at 6%.

“The surge in AI-driven bot creation has serious implications for businesses worldwide,” said Tim Chang, General Manager of Application Security at Thales. “As automated traffic accounts for more than half of all web activity, organizations face heightened risks from bad bots, which are becoming more prolific every day.”

As attackers become more adept at utilizing AI, they can execute a variety of cyber threats—ranging from DDoS attacks to custom rules exploitation and API violations. While bot-driven attacks have become increasingly sophisticated, they pose significant challenges for detection efforts.

“This year’s report sheds light on the evolving tactics and techniques utilized by bot attackers. What were once deemed advanced evasion methods have now become standard practice for many malicious bots,” Chang said. “In this rapidly changing environment, businesses must evolve their strategies. It's crucial to adopt an adaptive and proactive approach, leveraging sophisticated bot detection tools and comprehensive cybersecurity management solutions to build a resilient defense against the ever-shifting landscape of bot-related threats.”

Bad Bots Targeting API Business Logic Pose Increased Threat to Modern Enterprises

Recent findings from the Imperva Threat Research team reveal a significant surge in API-directed attacks, with 44% of advanced bot traffic targeting APIs. These attacks aren't just limited to overwhelming API endpoints; rather, they target the intricate business logic that defines how APIs operate. Attackers deploy bots specifically designed to exploit vulnerabilities in API workflows, engaging in automated payment fraud, account hijacking, and data exfiltration.

Analysis in the report reveals a deliberate strategy by cyber attackers to exploit API endpoints that manage sensitive and high-value data. Implications of this trend are especially impactful for industries that rely on APIs for their critical operations and transactions. Financial services, healthcare, and e-commerce sectors are bearing the brunt of these sophisticated bot attacks, making them prime targets for malicious actors seeking to breach sensitive information.

APIs serve as the backbone of modern applications, enabling connectivity across services, streamlining operations, and delivering personalized customer experiences at scale. They underpin essential functions such as payment processing, supply chain management, and AI-driven analytics, making them indispensable for enhancing efficiency, accelerating product development, and unlocking new revenue streams.

“The business logic inherent to APIs is powerful, but it also creates unique vulnerabilities that malicious actors are eager to exploit,” Chang said. “As organizations embrace cloud-based services and microservices architectures, it’s vital to understand that the very features that make APIs essential can also leave them susceptible to risk of fraud and data breaches.”

Financial Services, Healthcare, and E-commerce Industries Face Heightened Risk

The 2025 Imperva Bad Bot Report provides an in-depth analysis highlighting the industries most at risk. Financial services, healthcare, and e-commerce are the most affected sectors, industries that rely on APIs for critical operations and sensitive transactions, making them attractive targets for sophisticated bot attacks.

The financial services sector was the most targeted industry for account takeover (ATO) attacks, accounting for 22% of all incidents, followed by Telecoms and ISPs with 18%, and Computing & IT with 17%. Financial Services has long been a prime target for ATO attacks due to the high value of accounts and the sensitive nature of the data at stake. Banks, credit card companies, and fintech platforms possess vast amounts of Personally Identifiable Information (PII), including credit card and bank account details, which can be profitably sold on the dark web. Additionally, the growing proliferation of APIs within the industry has broadened the attack surface, allowing cyber criminals to exploit vulnerabilities such as weak authentication and authorization methods, thereby facilitating account takeovers and data theft.

About the Research

The 12th Annual Imperva Bad Bot Report is based on insights from our Threat Research and Security Analyst Services (SAS) teams. Our analysis draws from data collected from across the Imperva global network in 2024, including the blocking of 13 trillion bad bot requests across thousands of domains and industries. This dataset provides key insights into bot activity to help organizations understand and address the growing risks of automated attacks.

About Thales

Thales (Euronext Paris: HO) is a global leader in advanced technologies for the Defence, Aerospace, and Cyber & Digital sectors. Its portfolio of innovative products and services addresses several major challenges: sovereignty, security, sustainability and inclusion.

The Group invests more than €4 billion per year in Research & Development in key areas, particularly for critical environments, such as Artificial Intelligence, cybersecurity, quantum and cloud technologies.

Thales has more than 83,000 employees in 68 countries. In 2024, the Group generated sales of €20.6 billion.

PLEASE VISIT
Thales Group
Cybersecurity Products
Cybersecurity Solutions

©Thales

©Thales

BEIRUT (AP) — Hezbollah on Thursday rejected the latest ceasefire agreement between Israel and the Lebanese government, and the militant group demanded a complete Israeli withdrawal from Lebanon as more fighting there hampered efforts to end the Iran war.

The Hezbollah announcement came as Israeli strikes killed at least four people, according to local authorities, and a U.N. peacekeeper was killed in the crossfire.

Hezbollah leader Naim Kassem, in a written statement read on TV, called the negotiations “absurd, humiliating and insulting.” He said the agreement’s demand that Hezbollah fighters leave southern Lebanon under fire would mean “surrender, defeat and achieving the enemy’s goals.”

“What we are concerned about is an end to the aggression, ceasefire and Israel’s withdrawal,” he said, underscoring that Hezbollah has not made any commitment to stop fighting. “So long as our villages are not safe and are being bombed and destroyed and our people are killed," he said, northern Israel “will not be safe.”

The fighting in Lebanon, where Israeli forces have seized large swaths of the south, threatens efforts to end the Iran war and reopen the Strait of Hormuz, a key transit point for oil and gas. Its closure has jolted the world economy.

Iran has demanded that any lasting truce extend to Lebanon. Israeli Prime Minister Benjamin Netanyahu, who faces elections later this year, wants to press ahead with Israel’s offensive until Hezbollah no longer poses a threat.

U.S. President Donald Trump, who faced a rare rebuke from Congress on Wednesday, has sought to downplay the diplomatic deadlock and the failure of declared ceasefires to end the fighting. He told reporters that in the Middle East that "a ceasefire is when you’re shooting in a more moderate manner.”

A Serbian peacekeeper was killed and two others were wounded when a mortar struck their location near Marjayoun, a Christian-majority town that has seen intense fighting, according to the U.N. mission in southern Lebanon, known as UNIFIL, and the Serbian Defense Ministry.

Israel later blamed Hezbollah for the firing that killed the U.N. peacekeeper, without offering evidence. Hezbollah and the U.N. did not immediately comment on who launched the shells.

Lebanon’s state-run National News Agency said a drone strike killed a motorcyclist and wounded four people in the village of Maaroub. It said airstrikes on the village of Sohmor in the Bekaa Valley, in eastern Lebanon, killed three people and wounded others. It also reported airstrikes elsewhere in the south.

There was no immediate comment from the Israeli military, which has warned people not to go into parts of southern Lebanon where it says it is striking Hezbollah facilities.

Hezbollah resumed rocket fire days after Israel and the United States launched their surprise Feb. 28 attack on Iran, which backs Hezbollah. Before then, Israel had regularly carried out strikes in Lebanon against what it said were militant targets, often killing civilians, despite an earlier truce reached in 2024.

Lt. Gen. Eyal Zamir, the Israeli military’s chief of staff, acknowledged Thursday that the ongoing war was straining northern Israeli towns living under the threat of Hezbollah fire. He said Israel's operations in Iran and Lebanon had “created a new security reality,” by weakening Iran and Hezbollah “to an unprecedented degree.”

After Hezbollah's rocket and drone attacks resumed, Israeli troops seized around a fifth of Lebanon, pushing further into the country's south than at any time since the end of Israel’s 1982-2000 occupation.

In the southern city of Sidon, residents reacted to Wednesday's ceasefire announcement with skepticism, saying previous agreements had failed to stop the violence.

“Every few days a ceasefire is announced, but people keep getting killed,” said Mayada Hijazi.

“It’s all talk and no action,” said Salah Nassab. “We keep going back to our homes, and then we get displaced again, back and forth. We’re very tired."

More than 3,500 people have been killed in Lebanon, and over 1.2 million have been displaced. The fighting has killed 27 Israeli soldiers and three civilians.

The latest declared ceasefire came about through U.S.-brokered talks between Israel and Lebanon's government, which accuses Hezbollah of dragging the country into war and had made efforts to disarm it before the latest hostilities.

The ceasefire agreement calls for Lebanon's armed forces to take control of security zones in Lebanon from which the militants would be banned.

Lebanese President Joseph Aoun on Thursday called the new agreement "the last chance to enter a final and comprehensive ceasefire.” He said Lebanon was ready to implement Wednesday's deal once he receives responses from relevant factions in Lebanon, including Hezbollah. The United States — and Trump himself — would determine how and when the deal is implemented, Aoun told journalists.

The agreement terms Hezbollah “an enemy" of Israel, the U.S. and Lebanon and calls for dismantling it. The government has promised to do so in the past but does not have the capabilities to disarm Hezbollah by force.

The latest agreement did not say when Israel would withdraw from southern Lebanon but said the U.S. would support the Lebanese army as it works to assert control in areas where Hezbollah has long wielded power.

A top Iranian general on Thursday reiterated Tehran's demand for a full ceasefire in Lebanon and called for Israel to pull troops back to where they were when the wider war began. At that time, Israel held five strategic points along the border.

“Supporting the resistance in Lebanon is the duty of all of us, and eliminating Israel from the region is an achievable goal for Muslims,” Esmail Qaani, the head of the paramilitary Revolutionary Guard’s elite Quds Force, was quoted as saying by the semiofficial Fars and Tasnim news agencies.

As diplomatic efforts have repeatedly faltered, Iran and the U.S. have traded fire in and around the Strait of Hormuz, which remains effectively closed. Before the war, around a fifth of the world's oil and gas, as well as large shipments of fertilizer and other goods, passed through the narrow waterway.

The U.S. has targeted what it says are Iranian threats to commercial shipping and its own forces, while Iran has launched missile and drone attacks on Gulf states hosting U.S. troops.

Israeli troops gather on the border with Lebanon in northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Israeli troops gather on the border with Lebanon in northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Israeli troops gather on the border with Lebanon in northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Israeli troops gather on the border with Lebanon in northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Israeli soldiers drive in southern Lebanon as seen from northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Israeli soldiers drive in southern Lebanon as seen from northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Smoke rises near the Beaufort Castle in southern Lebanon as seen from northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Smoke rises near the Beaufort Castle in southern Lebanon as seen from northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

An Israeli flag hangs on a destroyed building in southern Lebanon as seen from northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

An Israeli flag hangs on a destroyed building in southern Lebanon as seen from northern Israel, Thursday June 4, 2026. (AP Photo/Ariel Schalit)

Recommended Articles