Bots Now Form Over Half of Global Internet Traffic in 2025, Driving API Attacks and Business Metric Distortion
Bots already account for the majority of internet traffic, creating challenges that extend far beyond traditional information security. In 2025, automated clients generated more than 50% of observed traffic, with malicious bots responsible for 40% of the total. The number of attacks leveraging AI-enabled automation grew 12.5 times compared with the previous year.
During the 81st anniversary of Victory Day, Garda WAF blocked over 3.5 million attacks and stopped more than 307,000 bot requests targeting the Immortal Regiment historical movement site. Industry reports vary because vendors analyze different networks and apply different counting methods, yet the consistent message is that human-generated requests can no longer be assumed by default.
Shift of automated traffic from web pages to APIs
Modern bots increasingly target APIs directly instead of emulating browsers. Akamai data shows a 113% rise in daily API attacks, with 87% of organizations reporting at least one API-related security incident. The share of attacks involving unauthorized business workflows grew from 30% to 61%.
At the same time, simple automated scripts remain dominant. Qrator Labs statistics for Q2 2025 indicate that basic bots generated 59% of protected bot traffic while API bots accounted for 38%. A single large botnet observed by the company contained more than 4.5 million devices, twenty times larger than the biggest network detected the previous year.
New categories of crawlers and agents
Cloudflare Radar data reveals that 40% of verified bot traffic came from search crawlers, 20% from AI crawlers, and 13% from SEO bots. The boundary between beneficial and harmful automation has blurred because AI agents can generate high load, consume content without returning visitors, or perform reconnaissance under the guise of legitimate use.
OWASP classifies automated abuse of legitimate application functions as automated threats. Common scenarios include credential stuffing, scraping of pricing and inventory data, gift-card enumeration, ticket hoarding, and market manipulation through fake reviews or demand signals.
Impact on business metrics and infrastructure
Bot traffic distorts web analytics by inflating session counts and lowering observed conversion rates. An example shows that 5,000 additional bot sessions can reduce measured conversion from 3% to 2% without any change in real customer behavior. Infrastructure resources are consumed for CDN traffic, database queries, and third-party service limits, while aggressive protection mechanisms such as repeated CAPTCHAs can degrade genuine user experience.
Detection now relies on combinations of signals rather than single indicators. JA3/JA4 TLS fingerprints, header ordering, JavaScript execution integrity, and behavioral patterns within sessions help distinguish automated clients even when they use real browser engines such as Chromium, Playwright, or Puppeteer.
Related articles
Reconstructed Stuxnet Source Code Published on GitHub with Build Instructions
An unknown researcher has released a reconstructed version of the Stuxnet worm source code on GitHub, including reverse-engineering results and assembly instructions. Stuxnet was discovered in 2010 and is widely attributed to the joint US-Israeli Olympic Games operation targeting Iran's Natanz uranium enrichment facility. The malware specifically attacked Siemens industrial controllers by altering frequency converter operations to physically damage centrifuge rotors while falsifying operator displays. Propagation relied on USB drives, network shares, and a Windows Print Spooler vulnerability, combined with stolen Realtek and JMicron driver-signing certificates. The worm also injected itself into Siemens WinCC and Step 7 software to intercept communications with programmable logic controllers. Due to a flaw in its environment checks, Stuxnet escaped the target network and spread publicly before its built-in June 2012 self-destruct date. Researchers are advised to analyze the code only inside fully isolated virtual machines without network access.
Researchers Create 0-Click WeChat Worm That Hijacks Accounts via Incoming Calls
Security researchers at Calif have developed a 0-click worm capable of compromising WeChat accounts through incoming voice calls without any user interaction. The exploit requires only that the attacker already exists in the victim's contact list and works across Android and iOS devices. In demonstrations, an infected Android device called an iPhone to seize control of its WeChat account while the call continued ringing, after which the compromised iPhone targeted another Android device. The worm spreads automatically between trusted contacts, functioning like a classic network worm but using WeChat profiles as propagation nodes. Even if the victim answers or declines the call, the exploit can persist or be retried, for example during nighttime hours. After account takeover, attackers gain full control to read and send messages, make calls, and impersonate the owner, while the underlying smartphone itself remains unaffected. Tencent received notification in July, released patches in versions 8.0.77 for Android and 8.0.76 for iOS, and server-side blocking was confirmed by late August, with no real-world attacks observed so far.
Website Protection Against Bots: Six Years of Traffic Filtering Evolution from Behavioral Bots to Multi-Layer Analytics
The article traces the author's journey starting in 2020 when anomalous traffic from social networks began flooding websites, initially appearing as visits from Twitter, Instagram, YouTube, and VKontakte. Early attempts using .htaccess rules to block referrers failed as bots dynamically switched to direct or external domain transitions. Server-side JavaScript and cookie checks altered bot behavior but did not stop the flow, revealing that successful browser checks only confirm technical capability rather than human presence. IP blocking of ranges like 31.173.80.0/21 and 178.176.64.0/19 provided temporary relief until mobile proxies rotated addresses, exposing the limits of static blacklists. IPv6 adoption further demonstrated how address-family-specific rules quickly become obsolete. Fingerprint spoofing and constant rotation of digital prints made single-signal identification unreliable. The core lesson emphasizes real-time filtering at the edge over post-hoc analytics exclusion to prevent bots from reaching the web server at all.
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.