The term “cook group” is steeped in jargon from the resell and botting community. Configurations are “recipes,” the people who run the automations are “chefs,” and those who “cook” during a drop are admired and begged to share the “secret sauce.” “Gatekeeping” is reserved for those who won’t share their expertise — like a grandmother who shares her famous cookie recipe but withholds three key ingredients, so you can never quite reproduce the results.
In the past, gaining access to these communities took significant effort and risk. Security and development teams pieced together clues from logs, security events, and threat feeds, often without a complete picture. The pandemic changed that: supply-chain constraints and product shortages pushed retail automation software into the spotlight, and gave us a chance to observe, participate, and document the tech stack behind retail botting. Our mission is to share the “secret sauce” with the broader security community so we can collectively build a better defense.
Why should you care?
Picture a cooking competition where a master chef has become an expert in a particular retailer’s weaknesses. With a seasoned cook group, they’ve built precise recipes to exploit those weaknesses, practiced each technique, and automated wherever possible for flawless execution under pressure. Meanwhile an inexperienced cook, with no plan, burns dishes under the same constraints. The master chef’s team moves through the competition effortlessly, long before the novice can even react.
Our initial bias led us to underestimate these “master chefs.” After researching the space, we realized they’re far more advanced: small companies staffed with skilled developers, pulling talent from around the globe, building sophisticated modules. AI has significantly enhanced their capabilities, enabling rapid innovation in overcoming the bot-management controls that companies of all sizes use to safeguard high-security transaction flows.
What is a cook group?
A cook group is a community of resellers and bot operators who share information and strategy to maximize success — from identifying the most profitable products to optimizing the entire botting process. Their benefits to members include:
- Weekly and daily events — leaders share which products will be most profitable, with images, SKUs, drop times, prices, and estimated resale values.
- Bot setup guidance — step-by-step documentation on configuring software, proxies, and payment methods for a smooth checkout.
- Real-time monitors — tools that continuously scrape sites for inventory updates, increasingly integrated with automation so tasks start the instant stock is detected.
- Community and training — a strong environment where members share tips and help each other succeed, pooling collective knowledge and experience.
Especially in this era of scarcity marketing, cook groups are more dedicated and active than ever, transforming what might seem like a solitary endeavor into a collaborative, strategic effort — and they keep adapting as economic conditions change.
So, what do we do?
The open, gatekeeping-free knowledge-sharing in these communities has led to increasingly sophisticated attacks, and their methodologies closely mirror those of more malicious actors. That underscores the need for our industry to be just as organized and informed. A defense-in-depth strategy is more essential than ever; no single-point solution can secure your perimeter against AI-powered bots.
For bot operators, engaging with a well-organized cook group dramatically improves their odds. The same is true for the security community. Protecting customers and blocking bots starts with understanding the dynamics of cook groups and the strategies we’re up against. That’s why we’re building the Vesal Security Hub — a Discord community and learning playground that takes you behind the scenes of the botting world and gives you the “day one” tools to strengthen your defenses.