Especially during the holiday shopping season, retailers’ APIs and apps are being targeted for account takeovers by bad bots.

According to the 2023 Imperva Bad Bot Report, 17% of all attacks on APIs came from bad bots abusing business logic. Attack patterns don’t exist to monitor for these exploitations, and it’s impossible to apply a generic rule and assume all application and API deployments are secure.

“The pandemic accelerated the digital transformation of Asia’s retail sector, as companies swiftly adapted to changing consumer needs. However, the region’s diverse markets, complex supply chains, and varying cybersecurity readiness levels have left Asian retailers vulnerable to increasingly complex security threats,” says George Lee, Senior Vice President, Asia Pacific and Japan, Imperva. 

“The surge in bot sophistication over the past year is especially concerning, as this breed of automation can exploit business logic, compromise APIs, and take over user accounts, posing a tangible threat to retailers’ year-end  sales and impacting their bottom line.”

Some very recent additional findings from Imperva include:

1. Web traffic rises steadily throughout October and November as Cyber Monday dethrones Black Friday as the online holiday shopping event of the season

The holiday shopping season is starting earlier than ever before, evidenced by the steady rise in web traffic across retail sites in October and November.

Unlike prior years when Black Friday was the milestone sales event of the holiday shopping season, shoppers took advantage of promotions and sales in early November. In 2023, the peak in online traffic was recorded on November 19 with a second notable peak occurring on Cyber Monday (November 27). In fact, there was 42% more web traffic on retail sites on Cyber Monday than on Black Friday.

2. Volume of bad bots rises during the holiday shopping season

Bad bots account for 26.3% of all web traffic to online retail websites, higher than the annual average of 22.7%. Human traffic on retail sites dropped by nearly 3% while the proportion of good bot traffic remained similar to the annual average.

3. Account takeover (ATO) attacks have been rampant throughout the holiday shopping season

The number of ATO attacks have risen since September, with a spike in attack activity recorded on November 8, 14, and 24 (Black Friday). 

The number of attacks spiked by an astonishing 85% on Black Friday. For comparison, ATO attacks on Black Friday 2022 increased by 66%.

The intensity of these attacks is also increasing. The number of malicious login requests soared 82% between October and November.

We’ve also monitored frequent spikes in account takeover attacks targeting online retailers’ APIs this holiday shopping season, with a notable peak in late October. 

4. Attacks targeting retailers’ APIs increases as the holiday season progresses

API traffic accounts for 45.8% of all traffic to online retailers, up from 41.6% last year. With that in mind, the rise in attacks targeting online retailers’ APIs becomes quite notable. Attacks increased by 6% in October and another 9% in November.

These attacks could be designed to expose a business logic vulnerability, an exploit of an application’s intended functionality and processes. In retail, attackers can exploit business logic to manipulate pricing or access restricted products.