Cybercriminals have launched a new campaign by impersonating well-known AI bots, such as ChatGPT, Claude, and Perplexity, to search for sensitive information on websites, including passwords and API keys. This operation takes advantage of the trust businesses place in these AI services to bypass security measures.
Impersonation Tactics and Security Weaknesses
The attackers use AI service names to mask their scanning activities, exploiting a critical flaw in how organizations identify automated visitors. This approach has been previously observed in attacks on development servers, where impersonated bots were employed to locate sensitive files. In this case, the primary goal is to collect credentials rather than typical web data.
Research by Cequence has linked this malicious activity to a single actor using approximately 32 different AI bot identities. According to their report on October 28, nearly half of the Cequence-protected organizations received AI bot traffic from this scam on a single day, highlighting the widespread nature of this threat.
Techniques and Targeted Industries
The scanner operates from a major cloud provider, adopting identities from OpenAI, Anthropic, Meta, and others. Instead of accessing regular web pages, the scanner requests files containing cloud credentials, private SSH keys, and server environment data. Researchers discovered a target list of about 90 file paths, which can provide unauthorized access to critical systems.
Although there is evidence of credential-seeking behavior, no confirmed data breaches have been reported. The scanning activity involved issuing 50 to 190 requests in a rapid succession of eight seconds, affecting industries such as financial services, retail, telecommunications, energy, and software from late September to late October.
Challenges in Address-Based Defenses
The impersonation tactics became apparent when researchers noted that a single machine claimed multiple AI provider identities within seconds. This inconsistency, along with shared infrastructure, linked the activities across various targets. The attacker also used a rotating pool of over 300 cloud addresses daily, complicating efforts to block IP addresses effectively.
This campaign underscores the importance of robust identity verification beyond IP blocklists. The fake AI bot traffic distorted security metrics, creating a false sense of legitimate activity. Cequence advises using signed requests and direct integrations to verify agents, alongside inspecting the nature of requests to spot suspicious behavior.
Recommendations for Enhanced Security
Organizations are urged to improve their identity and access management strategies by not relying solely on the bot’s name for access approval. Security teams should ensure that sensitive files, staging systems, and administrative sites are not publicly accessible. Broader controls over AI agent identity and permissions are essential to prevent similar attacks in the future.
Indicators of compromise include short bursts of request activity, rotating AI bot identities, and repeated attempts to access specific file paths. Integrating threat intelligence from multiple sources can help security operations centers respond swiftly to such incidents.
