8 minhigh
Smash and Grab at Scale: Agentic AI Is Reshaping the Threat to Commerce
Akamai's SOTI Security report details how agentic AI is reshaping the threat landscape for commerce, with a 19% YoY increase in AI bot traffic and over 200 billion application/API attacks between 2024 and 2025. Attackers are exploiting consumer-facing chatbots through logic manipulation, back-end AI agents via prompt injection, and public AI endpoints for token freeloading. The retail vertical bore the brunt of Layer 7 DDoS activity (84%), with hacktivist groups like 313 Team leveraging Mirai-derived IoT botnets and browser impersonation for multi-vector attacks.
Conf:medium
Detection / Hunteropenrouter
What Happened
A new report from Akamai describes how artificial intelligence tools used in online shopping are being weaponized by attackers to target retail and commerce businesses. Attackers are manipulating AI chatbots to bypass business rules, injecting malicious prompts into back-end AI systems, and abusing retailers' AI computing resources to drive up their costs. The retail industry faced over 200 billion attacks on apps and APIs and nearly three trillion denial-of-service attacks in 2025 alone. A hacktivist group linked to Iran is using compromised internet-of-things devices and fake web browser traffic to overwhelm ecommerce systems. Organizations that operate online storefronts should review their bot management, API security, and network segmentation strategies, and consider implementing risk-based multi-factor authentication to reduce exposure.
Key Takeaways
- AI bot traffic targeting commerce increased 19% year-over-year in 2025, with retail as the most targeted vertical.
- Attackers are exploiting consumer-facing chatbots via logic manipulation ('leaky faucet' attacks), back-end AI agents via prompt injection, and public AI endpoints for token freeloading to drain infrastructure resources.
- Commerce faced over 200 billion application/API attacks and nearly 3 trillion Layer 7 DDoS attacks between 2024 and 2025, with 84% of DDoS activity targeting retail.
- Iran-aligned hacktivist group 313 Team is combining Mirai-derived IoT botnets, browser impersonation, and complex DDoS to target ecommerce APIs.
- API attacks increased 9% YoY (Q4 2024 to Q4 2025), signaling a shift toward APIs as preferred initial entry points.
Affected Systems
- Ecommerce web applications and APIs
- Consumer-facing AI chatbots
- Back-end conversational AI agents
- Public-facing AI endpoints (token inference APIs)
- WordPress Jupiter X Core plugin
- WordPress WooCommerce plugin
- IoT devices (Mirai-derived botnet targets)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Attackers identify consumer-facing AI chatbots, back-end AI agents, and public-facing AI endpoints as targets on commerce platforms.
- Initial Access: Automated bots impersonating legitimate browsers interact with ecommerce APIs and chatbot interfaces to probe for logic flaws and exploitable parameters.
- Execution: Prompt injection and 'leaky faucet' logic exploits are used to manipulate AI chatbots and back-end agents into overriding business rules or performing unauthorized actions.
- Resource Abuse: Automated scripts route processing workloads and model-training queries through retailer AI endpoints to freeloading tokens and degrade performance.
- Denial of Service: Mirai-derived IoT botnets and HTTP flood attacks overwhelm application servers and APIs to block legitimate traffic.
- Credential Harvesting: Fake retail sites and spoofed login portals are deployed to collect customer credentials.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article is a blog post summarizing a SOTI Security report and does not contain any detection rules, queries, or signatures. The full report may contain additional technical details but none are provided in this article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The attacks described are primarily web-application and API-layer attacks (DDoS, bot traffic, prompt injection, API exploitation) that occur at the network edge rather than on endpoints. EDR telemetry would have minimal visibility into these attack vectors. |
| Network Visibility | High | The article describes Layer 7 DDoS, API attacks, bot traffic patterns, and browser impersonation — all of which are detectable through WAF, bot management, and network traffic analysis tools positioned at the edge. |
| Detection Difficulty | Hard | Distinguishing legitimate AI-assisted customer traffic from malicious bot activity is inherently complex because attackers deliberately mimic legitimate browser behavior and customer interactions. The rise of browser impersonators and AI-driven bots makes traditional signature-based detection insufficient. |
Required Log Sources
- WAF logs
- API gateway logs
- Bot management solution logs
- CDN/edge traffic logs
- Application server access logs
- AI endpoint usage logs (token consumption metrics)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for anomalous API call patterns where a single source or distributed set of sources makes methodical parameter variations against chatbot endpoints, consistent with 'leaky faucet' logic exploitation (T1190). | WAF logs, API gateway logs, application server access logs | Initial Access / Execution | Medium — legitimate automated testing, QA scripts, or aggressive price-comparison bots may produce similar patterns. |
| Consider hunting for sudden spikes in AI token consumption or inference API calls from external IPs that correlate with bot-like traffic patterns, indicating AI token freeloading activity. | AI endpoint usage logs, API gateway logs, cloud billing/usage metrics | Resource Abuse | Low to Medium — legitimate traffic surges during sales events could mimic this, but sustained anomalous consumption from non-customer IPs is suspicious. |
| Consider hunting for HTTP flood patterns targeting ecommerce APIs where User-Agent strings indicate browser impersonation but behavioral fingerprints (TLS fingerprint, header ordering, request timing) do not match the claimed browser. | CDN/edge traffic logs, bot management solution telemetry, WAF logs | Denial of Service | Low — legitimate browsers should match their claimed User-Agent across all fingerprinting dimensions. |
| Consider hunting for IoT-derived botnet traffic signatures (consistent with Mirai variants) targeting commerce APIs, particularly from geographically distributed low-reputation IP ranges. | Network flow data, WAF logs, threat intelligence feeds, IP reputation databases | Initial Access / Denial of Service | Low — IoT botnet traffic patterns are generally distinct from legitimate customer traffic. |
Control Gaps
- Traditional perimeter security (WAF alone) is insufficient to distinguish AI bot traffic from legitimate automated customer interactions.
- API security gaps exist where shadow APIs and unmapped endpoints provide entry points not covered by existing bot management or rate-limiting controls.
- Consumer-facing AI chatbots lack input validation and business-rule enforcement to prevent logic manipulation attacks.
- Back-end AI agents with deep system integration may not have guardrails against prompt injection or jailbreak attempts.
- Public-facing AI endpoints may lack rate limiting or usage quotas to prevent token freeloading abuse.
Key Behavioral Indicators
- Methodical parameter variation patterns against chatbot endpoints suggesting automated logic exploitation
- Anomalous AI token consumption spikes from external or non-authenticated sources
- User-Agent strings claiming to be specific browsers but with mismatched TLS fingerprints or header ordering
- Distributed HTTP flood traffic targeting specific API endpoints from low-reputation IP ranges
- IoT device traffic patterns (consistent with Mirai variants) directed at commerce APIs
- Spoofed login portals or fake retail sites using typosquatted domains for credential harvesting
False Positive Assessment
High — The core challenge described in the article is that AI-driven bot traffic increasingly mimics legitimate customer interactions, making it difficult to distinguish malicious automation from legitimate automated shopping tools, price comparison bots, and genuine customer traffic. Browser impersonation techniques further blur this line.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing WAF and bot management policies for commerce-facing applications to ensure browser impersonation detection and rate limiting are enabled on critical API endpoints.
- If your organization operates consumer-facing AI chatbots, consider evaluating input validation and business-rule enforcement controls to mitigate logic manipulation ('leaky faucet') attacks.
- Consider implementing or tightening rate limits and usage quotas on public-facing AI inference endpoints to prevent token freeloading abuse.
- If applicable, evaluate whether your DDoS mitigation posture is adequate for peak shopping periods, including edge rate control and IP reputation checking.
Infrastructure Hardening
- Consider conducting a comprehensive API mapping exercise to identify all exposed and shadow APIs in your commerce environment.
- Evaluate whether microsegmentation is properly implemented to limit the blast radius of a compromised AI agent or API endpoint.
- Consider implementing risk-based multi-factor authentication for high-value transactions and loyalty point systems.
- If your organization uses WordPress for commerce, consider patching the Jupiter X Core and WooCommerce plugins to their latest versions and monitoring for exploitation attempts.
User Protection
- Consider deploying or enhancing bot management solutions that can classify and flag specific types of AI bot traffic versus legitimate automated customer interactions.
- Evaluate whether customer-facing login portals have anti-phishing protections such as brand monitoring for typosquatted domains.
- Consider implementing anomaly detection for loyalty point redemption and synthetic identity fraud patterns.
Security Awareness
- Consider incorporating awareness training for development teams on secure AI agent design, including prompt injection risks and jailbreak prevention.
- If applicable, consider rolling out customer-facing guidance on identifying fake retail sites and spoofed login portals.
- Consider establishing 'tolerable fraud' goals and security metrics at the executive level to align security investment with business risk appetite.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping6 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Lateral Movement
Tactic
