Hackers Impersonate ChatGPT, Claude and Perplexity to Hunt for Credentials
Attackers are impersonating well-known AI bots to scan websites for passwords, API keys and cloud credentials. They use names such as ChatGPT, Claude and Perplexity to disguise automated probing and test whether sites will accept requests simply because they appear to come from familiar providers.
The campaign exposes a fundamental weakness in how organizations identify automated visitors: a claimed identity is not proof of origin. Similar impersonation tactics have been seen in scans of exposed development servers, where scanners posed as legitimate bots while searching for sensitive files.
In this case the disguise supports credential hunting rather than ordinary web indexing. Researchers at Cequence linked the scanning activity to a single actor that impersonated roughly 32 different AI bot identities.
In an October 28 report, CQ Prime research director Will Glazier said the actor reached 48% of Cequence-protected organizations that received any AI bot traffic on a single October day. The report describes a malicious scanner, not a new malware family.
How the scanner operated
Operating from infrastructure in a major cloud provider, the scanner rotated through identities associated with OpenAI, Anthropic, Meta, Perplexity and others. Rather than requesting ordinary content, it asked for configuration files, cloud credential files, private SSH keys and server environment data. Researchers observed a target list with roughly 90 file paths.
Those files can provide access beyond the website itself: prior incidents involving exposed environment files show how leaked cloud credentials can enable privilege escalation and data theft. Cequence’s findings demonstrate credential-seeking activity in this campaign, though they did not confirm theft or subsequent compromise.
Each scanning address issued between about 50 and 190 requests over an interval of roughly eight seconds before moving on. The actor scanned targets individually and continuously, first issuing random or meaningless paths to identify sites that returned responses for every request.
Activity affected organizations in financial services, retail, telecommunications, energy and software sectors from at least late September through late October. The impersonation was revealed when researchers compared request behavior: a single machine would claim to represent several unrelated AI providers within seconds while cycling evenly through the 32 identities. Some fake Claude identities even reused Anthropic’s crawler contact address while claiming to be different Claude agents. Shared infrastructure and technical fingerprints connected the activity across targets.
Why identity verification matters more than IP blocklists
Address-based defenses were ineffective because the actor rotated infrastructure rapidly. The scanner used more than 300 cloud addresses in a single day and nearly 400 addresses over one week. Addresses observed in late September did not reappear a month later. Although many addresses were flagged by external threat feeds while in use, the scanner typically moved elsewhere before defenders could act.
This campaign involves outsiders pretending to be trusted agents, which is different from incidents where legitimate AI tools accidentally expose credentials while performing routine tasks. Both scenarios highlight the need for robust identity and access controls, but they require different investigations: defenders must distinguish forged visitors from genuine agents whose permissions or data handling create risk.
The scanner also distorted traffic metrics. At several organizations it generated more than 80% of requests labeled as AI bot traffic. That does not mean genuine AI services launched the attacks; it shows how trusting a visitor’s self-description can make malicious scanning appear as legitimate activity in security dashboards.
Cequence recommends verifying agent identity through signed requests, published address ranges or direct integrations. Teams should also monitor behavior for requests targeting credential files and ensure secrets, staging systems and administrative interfaces are not publicly accessible. Broader AI agent identity controls should address ownership and permissions; a familiar bot name alone should never grant access.
Indicators of compromise (IoCs)
| Type | Reported indicator | Hunting relevance |
|---|---|---|
| Targeted file | .env |
Configuration file commonly sought for exposed secrets. |
| Request burst | 50–190 requests in about eight seconds | Short, concentrated scanning activity that may indicate automated probing. |
| Identity pattern | Approximately 32 rotating AI bot identities | Correlate inconsistent provider claims across requests. |
| Targeting pattern | Roughly 90 file paths | Repeated searches for sensitive files and credential material. |
Note: IP addresses and domains in threat reports are often intentionally Q-defanged (for example, written with “[.]”) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal or your SIEM.
Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from thousands of SOCs to improve detection and response.
