Cybercrime: Nearly three-quarters of web traffic is malicious, travel industry the most jeopardized

SAN MATEO, CALIF – Arkose Labs, a global leader in bot management and account security, released its threat intelligence report analyzing the contemporary attack landscape. The report, “Breaking (Bad) Bots: Bot Abuse Analysis and other Fraud Benchmarks” found that bots and human fraud farms were responsible for billions of attacks in the first half of 2023 and into Q3. These attacks comprised 73 percent of all website and app traffic measured. In other words, almost three-quarters of traffic to digital properties is malicious.

The report studied billions of sessions worldwide across industries to reveal the top attacks by industry, type, and region. Researchers assessed the attacks across three primary attack vectors: basic bots, intelligent bots, and human fraud farms. Fraudsters use these vectors to launch attack types such as SMS toll fraud, web scraping, card testing, credential stuffing, and more.

The analysis found bot attacks overall increased 167 percent in the first half of the year, weighted heavily by a 291 percent increase in intelligent bots. These smart bots are capable of complex, context-aware interactions. The attacks, though, weren’t limited to bots. Research found that when fraudsters’ bots are blocked, they pivot attacks to human fraud farms, which increased 49 percent from Q1 to Q2 2023.

“Bot attacks aided by human fraud farms are about more than concert tickets and high-priced sneakers. They can point to far darker activities,” said Kevin Gosschalk, founder and CEO of Arkose Labs. “We’re seeing more attacks, using more intelligent bots, conducting more sophisticated types of attacks. Fake account registration, credential stuffing, scraping, SMS toll fraud–these are the types of attacks that fraudsters use as the first steps to more harmful crimes. They lead to romance scams that groom for human trafficking, money laundering from drug deals, or theft to fund illegal weapons.”

Two trends are highlighted in the report as driving the increase in attack level: Generative AI (GenAI), and Cybercrime-as-a-Service (CaaS).

During the past six months, Arkose Labs’ threat researchers have observed a significant uptick of GenAI being used for content generation by bad actors who are now able to write pristine phishing emails for Man-in-the-Middle attacks or perfectly-worded responses on dating apps in their romance scams. In addition, the researchers found attackers are using bots to scrape data from websites and then using that data to tune their GenAI models.

An equally prodigious trend, Cybercrime-as-a-Service (CaaS) lowers the barrier to entry for adversaries looking to commit cybercrime. CaaS vendors advertise their questionably-legal services openly. Anyone can reach out to these vendors to buy bots to circumvent security measures or carry out an attack. Fraudsters with limited to zero technical skills can then use fully automated bots at scale that cause widespread damage to businesses and consumers. Fraudsters no longer have to know how to code to deploy a sophisticated volumetric bot attack. They can simply buy the bots off the web along with the training they need and even tap into the sellers’ “customer” support.

Gosschalk added, “The massive rise of CaaS has completely changed the economics for adversaries. It’s much cheaper to attack companies and the attacks are just better because it’s a dev shop that is doing the attacks instead of just individual cybercriminals.”