Over 40,000 cyberattacks target API environments

The cybersecurity landscape has witnessed an unprecedented increase in attacks focused on APIs in the first half of 2025, with malicious actors launching over 40,000 recorded incidents against application programming interfaces across 4,000 environments.

See also: United Kingdom: Students behind cyberattacks on schools

This alarming escalation represents a fundamental shift in attack methodology, as cybercriminals have identified APIs as the most profitable and vulnerable entry points into modern digital infrastructure.

Unlike traditional attacks on web applications that require human interaction, API-based campaigns can be fully automated, allowing attackers to execute millions of malicious requests with minimal manual oversight.

The sophistication of these attacks has evolved beyond simple identifier detections, to include exploitation of complex business logic, where attackers exploit legitimate API functionality to achieve unauthorized goals.

Modern malicious actors use browsers, residential proxy networks, and advanced automation frameworks to orchestrate campaigns that blend seamlessly with normal traffic patterns. These attacks target critical points such as authentication systems, payment processing interfaces, and data access points, with financial services bearing the brunt of the attack at 26% of all recorded incidents.

Imperva analysts identified a particularly worrying trend where attackers are concentrating 44% of advanced bot activity specifically in API environments, despite the fact that APIs only represent 14% of overall attack paths.

This disproportionate focus suggests that cybercriminals recognize APIs as high-value targets that offer direct routes to sensitive data and financial systems.

The research team documented cases where individual campaigns created application-level distributed denial-of-service attacks that reached 15 million requests per second against financial APIs, demonstrating the massive scale and coordination of modern API-centric enterprises.

See also: Universities: Cyberattacks and ways to protect yourself

Attack methodologies applied to API environments reveal a sophisticated understanding of application logic and business workflows. Malicious actors apply parameter spoofing techniques to manipulate checkout processes, execute promotional code abuse loops to drain marketing budgets, and conduct systematic credential stuffing operations against authentication points.

These attacks succeed because they use valid API calls that comply with documented specifications, making them invisible to signature-based detection systems and traditional web application firewalls.

The most worrying element of modern API attacks involves the systematic abuse of business logic through what security researchers call “valid request forgery.”

Attackers have developed sophisticated methods to identify and exploit logical inconsistencies present in complex API workflows, targeting multi-step processes such as e-commerce checkout sequences and financial transaction authorization chains.

These advanced campaigns typically begin with automated reconnaissance phases where attackers map API endpoints and identify parameter relationships using tools like Burp Suite and custom Python.

Once target endpoints are captured, malicious actors develop specialized automation frameworks that can execute thousands of seemingly valid requests while systematically probing for logical vulnerabilities.

For example, attackers may submit rapid sequences of promotional code validation requests, trying various combinations until valid codes are identified, and then redeeming them immediately before detection systems can react.

See also: Cybercriminals are shifting their focus to Generation Z

The persistence mechanisms used in these campaigns often include session token spoofing and distributed request distribution through multiple intermediaries.