Bots Now Form Over Half of Global Internet Traffic in 2025, Driving API Attacks and Business Metric Distortion
Bots already account for the majority of internet traffic, creating challenges that extend far beyond traditional information security. In 2025, automated clients generated more than 50% of observed traffic, with malicious bots responsible for 40% of the total. The number of attacks leveraging AI-enabled automation grew 12.5 times compared with the previous year.
During the 81st anniversary of Victory Day, Garda WAF blocked over 3.5 million attacks and stopped more than 307,000 bot requests targeting the Immortal Regiment historical movement site. Industry reports vary because vendors analyze different networks and apply different counting methods, yet the consistent message is that human-generated requests can no longer be assumed by default.
Shift of automated traffic from web pages to APIs
Modern bots increasingly target APIs directly instead of emulating browsers. Akamai data shows a 113% rise in daily API attacks, with 87% of organizations reporting at least one API-related security incident. The share of attacks involving unauthorized business workflows grew from 30% to 61%.
At the same time, simple automated scripts remain dominant. Qrator Labs statistics for Q2 2025 indicate that basic bots generated 59% of protected bot traffic while API bots accounted for 38%. A single large botnet observed by the company contained more than 4.5 million devices, twenty times larger than the biggest network detected the previous year.
New categories of crawlers and agents
Cloudflare Radar data reveals that 40% of verified bot traffic came from search crawlers, 20% from AI crawlers, and 13% from SEO bots. The boundary between beneficial and harmful automation has blurred because AI agents can generate high load, consume content without returning visitors, or perform reconnaissance under the guise of legitimate use.
OWASP classifies automated abuse of legitimate application functions as automated threats. Common scenarios include credential stuffing, scraping of pricing and inventory data, gift-card enumeration, ticket hoarding, and market manipulation through fake reviews or demand signals.
Impact on business metrics and infrastructure
Bot traffic distorts web analytics by inflating session counts and lowering observed conversion rates. An example shows that 5,000 additional bot sessions can reduce measured conversion from 3% to 2% without any change in real customer behavior. Infrastructure resources are consumed for CDN traffic, database queries, and third-party service limits, while aggressive protection mechanisms such as repeated CAPTCHAs can degrade genuine user experience.
Detection now relies on combinations of signals rather than single indicators. JA3/JA4 TLS fingerprints, header ordering, JavaScript execution integrity, and behavioral patterns within sessions help distinguish automated clients even when they use real browser engines such as Chromium, Playwright, or Puppeteer.
Related articles
Mimbrob Malware Uses Fake Dronner App to Target Russian Military and Industrial Firms
Researchers at F6 have identified a new malware campaign dubbed Mimbrob that leverages a fake drone-tracking application called Dronner. The lure promises data on heavy Baba Yaga drones and remote mining locations but instead deploys malicious payloads aimed primarily at Russian military personnel near the front line. The malware checks system language, keyboard layouts, and interface preferences, remaining dormant or terminating if Russian or certain CIS and Romanian languages are absent. Since April 2026 the same operators have conducted phishing campaigns against Russian industrial and IT companies using FBULoader disguised as a Yandex Browser update and the RAT-Go remote access trojan. The attackers register lookalike domains of legitimate Russian enterprises to deliver fake metrology notices and court documents. While espionage appears the most probable objective, researchers have not yet obtained the final payload and therefore refrain from definitive attribution.
Group-IB Discovers RemControl Android Banking Trojan Using Dynamic Overlay Attacks to Steal Banking PINs
Group-IB has identified a new Android banking trojan named RemControl with samples dating back to July 2026. The malware targets more than 30 financial institutions across Europe, the Middle East, and Canada, with Italy and France as primary focus areas. RemControl employs an overlay technique that displays a full-screen phishing replica of the legitimate banking app when the victim launches the real application, capturing PINs, access codes, and card details before seamlessly returning control to the authentic app. Phishing screens are not bundled in the APK but are fetched dynamically from operator-controlled servers reachable via Telegram channels, allowing rapid target changes without reinfection. Distribution relies on fake Google Play listing pages that mimic a streaming application, with geo-targeted delivery for Italian visitors. The trojan requests VPN permissions to block Play Store traffic and bypass real-time security checks, followed by accessibility service access that enables screen reading, keystroke logging, remote taps, and unlock pattern reconstruction.
Solar and F6 Integrate Solar webProxy with F6 Malware Detonation Platform to Filter Web Threats
GC Solar and F6 have confirmed compatibility between the Solar webProxy web access management system and the F6 Malware Detonation Platform. The integration allows Solar webProxy to pre-filter web objects and forward only suspicious files via the ICAP protocol to F6 MDP for reputation checks, static analysis, and dynamic detonation in an isolated virtual environment. Administrators can tune the level of filtering to avoid sending benign items such as fonts and icons to the sandbox, preserving resources for genuine threats. Data from the Solar webProxy team shows that archives accounted for an average of 37 percent of web threats in 2025, with malware frequently hidden inside ZIP, RAR, and 7Z containers. The solution targets medium and large organizations in finance, industry, and the public sector that handle high volumes of web traffic daily.
Engineer Tackles Jane Street ASIC Reverse Engineering Puzzle with Custom Simulator and Verilog Extraction
A detailed technical account describes how one engineer spent weeks reverse engineering an ASIC from GDS files provided in a Jane Street puzzle. The process began with parsing the GDS layout using the gdstk Python library to identify 27 cells in the warmup challenge and thousands of elements in the main task. The engineer built a custom logic simulator backed by SQLite, developed a domain-specific hardware description language, and eventually extracted a netlist that could be converted into Verilog for simulation. Key components identified included shift registers, an adder, and a comparator named comparitor496 in the warmup round. In the full challenge, nearly 10,000 instances of 81 different sky130 standard cells were processed, revealing an unexpected floating net that prompted a bug report to Jane Street. The effort combined manual schematic tracing, graph-based connectivity analysis, and waveform inspection with Surfer to confirm functional behavior.