AI enabling more 'grinch bot' attacks on popular gifts, researchers say

Grinch bots threaten holiday shopping

If you're having trouble finding a trending toy or gift on your shopping list, it might be due to grinch bots. FOX 26 Consumer Reporter Heather Sullivan has more on what they are and what they do.

HOUSTON - Having trouble getting your hands on a hot toy, gaming console, or popular gift this holiday season? It may be due to "grinch bots."

Cybersecurity experts say AI is enabling these bots to buy up even more stock than previous years, at an even faster pace.

What are "grinch bots"?

The backstory:

So-called grinch bots have been a problem for years. These are automated software programs that are used to rapidly purchase large amounts of highly sought-after toys, gaming consoles, and gifts, causing short supplies in the marketplace.

Consumers end up having to wait for new stock and pay much higher prices due to high demand or when the items are resold on the secondhand market.

Impact of grinch bots on shopping

What they're saying:

According to the 2025 Bad Bot Report by cybersecurity company Imperva, fraudsters are now using AI to make more grinch bot attacks than ever before. It found AI bots dominated Black Friday shopping.

In an effort to prevent bots from making purchases, many online retailers use CAPTCHA questions, puzzles asking you to click on pictures or type in letters to prove that you’re a human shopper. However, researchers say attackers are now using AI to solve CAPTCHA tests.

They say the attackers are also doing what’s called "credential stuffing," using stolen usernames and passwords to break into shoppers’ accounts on retail sites, then using their stored credit cards or loyalty points to make purchases. They have the items delivered to a different address. 

Congress passed the BOTS Act in 2016 to stop bots from buying up concert tickets, but efforts in Congress to pass the Grinch Bots Act have failed and Texas doesn’t have a law against them either. 

What you can do:

Cybersecurity experts recommend using a password manager to set unique passwords and store credit card information, rather than storing it on any retail site.