Security researchers have uncovered a brazen campaign where attackers are impersonating AI services like ChatGPT, Claude, and Perplexity to probe websites for passwords, API keys, cloud credentials, and other sensitive files. The goal isn’t mimicry—it’s credential harvesting.
How the Deception Works
Instead of crawling webpages in the usual way, the attackers issue requests for configuration files, private SSH keys, environment settings, and cloud credentials—assets that could give them control well beyond a site’s front end. The actor uses forged identities tied to around 32 different AI providers, cycling through names like OpenAI, Anthropic, Meta, Perplexity, among others, while testing whether websites blindly trust requests from familiar sources. Up to 90 file paths were found in their target list.
The operation spans from late September through late October and hit organizations across finance, retail, telecom, energy, and software sectors. On one day in October, the scanner was seen in nearly half of the organizations protected by Cequence that normally receive bot traffic.
Key Detection & Risks
The impersonator isn’t just randomly faking names—it’s abusing behavioral and infrastructure patterns. Multiple requests claiming different AI providers were sometimes made from the same machine within seconds. Shared infrastructure and repeated fingerprints tied the identities together. The bot also generated massive bursts of traffic: between 50 and 190 requests in an eight-second window per target before moving on.
Blocklisting IP addresses proved ineffective. More than 300 distinct cloud-based IPs were used in a single day, and no address stuck around for long. What looked like legitimate AI bot traffic in dashboards turned out to be largely fake, skewing metrics and potentially masking malicious behavior.
Recommendations & What to Watch
Defenders are advised to adopt stronger identity verification rather than rely on claimed identities. Signed requests, IP ranges published by known vendors, or direct integrations can help establish trust. Monitoring behavior—such as attempts to access configuration files—is critical. Secrets, admin portals, staging sites, and environment files should never be publicly exposed.
Indicators of compromise include: requests for “.env” configuration files; bursts of 50–190 requests in ~8 seconds; rotating identity claims (around 32 bot identities); looking through about 90 file paths. Guard these patterns tightly in logs, threat detection systems, and external feeds.
Why This Matters
Many organizations assume that if traffic appears to come from a trusted AI service, it’s legitimate. This campaign proves that’s a dangerous assumption. The reliance on familiar names, versus verified identity and behavior, invites attackers to exploit how bots are trusted. As AI agents proliferate, discerning real from fake becomes a critical part of cybersecurity hygiene.
The campaign doesn’t yet show confirmed breaches or data exfiltration, but it clearly lays the groundwork. Victims may not know how far into their infrastructure the attacker reached—or how much they saw.
Persistent attention to behavioral anomalies, infrastructure signatures, and access controls is no longer optional. Organizations should assume that brute IP blocking or superficial trust based on names won’t hold up against this kind of identity subversion. What’s at risk isn’t just data—it’s trust in the digital identity systems we’re building.
