Black Friday 2026 Predictions: 4 Bot Traffic Threats to Watch

The day before Black Friday 2025, nearly 1 in 4 login attempts HUMAN saw was an account takeover attempt. Black Friday, or as we sometimes call it, “Bot Friday,” is three weeks away, and this year attackers won’t be the only automated visitors. AI shopping agents are arriving in far greater numbers, and telling legitimate agents from malicious bots is now part of protecting the holiday season. Based on what HUMAN’s Satori Threat Intelligence team observed in 2025 and is seeing now, here are four trends to expect, plus steps organizations and shoppers can take before the rush.

Fraudsters don’t wait for Black Friday. As we saw ahead of the FIFA World Cup and the Super Bowl, they start hunting weeks in advance for credit card data, accounts and personal information. They also stage their bots to grab the same in-demand items real shoppers want, watch for promo codes and product launches, and cash in the accounts and payment methods they’ve compromised.

Our account takeover (ATO) data shows this preparation clearly. In the weeks before the 2025 shopping events, an average of 4.2% of daily login attempts were blocked as ATO. In the weeks after, that fell to 2.6%.

The spikes came right before each event. On Nov. 27, the day before Black Friday, 23% of login attempts were ATO, nearly 1 in 4 and roughly 5 times the rate in the preceding week. On Nov. 29, two days before Cyber Monday, the rate hit 18.6%, nearly 1 in 5 and 6.6 times the rate in the week after.

We expect the same pattern this year: a surge in ATO attempts in the days before Black Friday and Cyber Monday as attackers prepare for the main event.

Phishing sites that clone a brand’s website aren’t new. What’s changed is the cost. With AI tools widely available, threat actors can generate personalized phishing content at scale and quickly adapt it into timely holiday lures.

This year, we expect threat actors to use lookalike sites and phishing emails to steal credit card numbers, login credentials and other personal information, then sell it or use it for further fraud. That stolen data feeds directly into the ATO activity described above.

AI agents shopped heavily around Black Friday 2025. Agentic traffic during Black Friday week rose 23.8% over the week before, then fell 34.4% the week after. Compared with four weeks earlier, it was 25.8% higher; compared with four weeks later, 79.2% higher. Agentic activity was concentrated around the event and dropped off quickly.

More agentic requests were blocked during Black Friday week than in any other week, but the block rate was the lowest of the nine-week period: 4.7%, down from 5.3% the week before. That suggests a larger share of agentic traffic that week was legitimate shopping activity.

This year, we expect agentic traffic around Black Friday to be far higher in absolute terms, because it’s starting from a much bigger baseline. Adoption of existing agents has grown, and new ones, including [Muse, Grok Agent and Claude Duet], launched in recent months. Total agentic traffic HUMAN observed grew in most months from February through September 2026, jumping 209.7% in September alone. We attribute that growth to a combination of new agents, improved agent detection and broader adoption.

Black Friday used to mean one Friday and Cyber Monday one Monday. Many deals still drop on those days, but the 2026 shopping season started on Nov. 1, will escalate mid-month and peak starting Black Friday, Nov. 27.

Last year’s traffic followed that shape. Overall traffic to eCommerce sites climbed steadily in the weeks before Black Friday (Nov. 28, 2025), rose 15.2% during Black Friday week over the week before, then gradually returned to normal.

Start with visibility into all your traffic, especially AI agents. Today’s web traffic comes from humans, bots and AI agents, and deciding what to allow or block requires knowing who (or what) is on your site and the context behind each interaction. That context is what determines whether traffic can be trusted.

Don’t leave phishing defense to your customers. Security advice usually focuses on teaching individuals to spot phishing, but organizations also pay the price when phishing leads to malware, data theft or fraud with stolen accounts. Bot mitigation and account abuse detection stop the attacks phishing enables, even when a customer gets fooled.

Finally, expect familiar threats with new tools. Credential stuffing, ATO, promo code abuse, scalping, mass account creation and carding will all be back, and threat actors will increasingly fold AI agents into these tactics. HUMAN’s Satori Threat Intelligence team tracks how these threats evolve and feeds that intelligence back into our products.

Shoppers can protect themselves too. Use a different password for every account, especially email, banking and shopping accounts; they carry the highest ATO risk and are among the accounts we see sold most often on the dark web.

Watch your bank and shopping accounts for unusual activity, but only through official sites and apps. A common scam sends an email or text claiming you made a large purchase and asks you to call if you didn’t. Never call a number or click a link from one of these messages; look up the company’s official contact information yourself.