Threat landscape

The iGaming industry has always attracted automated abuse — but the sophistication and scale of AI-driven attacks in 2025 and early 2026 represents a qualitative shift. Our threat intelligence team tracked a 12x increase in AI-assisted bot traffic across our operator network between Q1 2024 and Q1 2026, driven primarily by the commoditisation of large language models capable of navigating registration flows, solving CAPTCHAs, and executing multi-step bonus strategies.

The economics are stark: a single operator running a mid-tier bonus programme can yield €40,000 to €120,000 per month to a well-organised bot operation. At today's LLM API prices, the cost to run such an operation is under €2,000/month. The return on investment for attackers has never been higher.

Attack vectors

We identified four primary attack vectors in our 2026 threat report. First, LLM-powered registration bots that solve behavioural challenges by mimicking human hesitation patterns and cursor movement distributions. Second, synthetic identity farmscombining AI-generated documents with real-world data harvested from data breaches. Third, coordinated bonus extraction rings using shared playbook execution across hundreds of accounts. Fourth, AI poker and sports betting advisors operating accounts at skill levels far beyond any human player.

Economics

The 12x surge is not just a volume story — it reflects a fundamental change in the cost structure of fraud. Traditional bot operations required significant human oversight: VPN infrastructure, device farms, manual account warming. AI agents collapse this cost dramatically. A single developer can now deploy and manage an operation that previously required a team of 20.

Defense strategies

Effective defense requires operating at the same layer as the attack. Rules-based systems — IP blocks, velocity checks, device deduplication — are table stakes that sophisticated operations trivially bypass. The durable countermeasures are behavioural graph analysis (detect coordination patterns across accounts), agent classification (distinguish AI sessions from human sessions before applying risk policies), and continuous model retraining against the adversarial distribution.

Outlook

We project AI bot traffic will continue growing at 8–12x annually through 2027, driven by further reductions in LLM inference costs and the maturation of open-source agent frameworks. Operators who invest in graph-native fraud infrastructure now will be significantly better positioned than those relying on point-in-time signal expansion.