Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys

Hackers are posing as trusted artificial intelligence bots to search websites for passwords, API keys, and cloud credentials.

The campaign uses the names of ChatGPT, Claude, Perplexity, and other AI services to disguise automated scanning, testing whether businesses will let requests through simply because they appear to come from a familiar provider.

The operation highlights a weakness in how organizations recognize automated visitors: a claimed identity is not proof of origin.

Similar AI crawler impersonation tactics have appeared in attacks against exposed development servers, where scanners used forged bot identities while looking for sensitive files.

Here, the disguise supports credential hunting rather than ordinary web crawling. Cequence researchers identified the malicious scanning campaign and linked it to a single actor impersonating about 32 AI bots.

In an October 28 report, CQ Prime research director Will Glazier said the actor reached 48% of Cequence-protected organizations receiving any AI bot traffic on one October day. The report describes a scanner, not a newly identified malware family.

Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots

Running from a major cloud provider, the scanner rotated through identities associated with OpenAI, Anthropic, Meta, Perplexity, and others.

Instead of reading normal pages, it requested configuration files, cloud credential files, private SSH keys, and server environment data. Researchers observed a target list containing roughly 90 file paths.

The distinction matters because these files can provide access beyond the website itself. Previous exposed environment file attacks have shown how leaked cloud credentials can support privilege escalation and data theft.

Cequence’s findings establish credential-seeking activity, however, not confirmed theft or subsequent compromise in this campaign. Each scanning address issued between 50 and 190 requests in roughly eight seconds before moving on.

The actor worked through targets individually, around the clock, and first requested random, meaningless paths to identify websites that returned responses for every request.

Activity affected financial services, retail, telecommunications, energy, and software organizations from at least late September through late October.

The impersonation became clear when researchers compared behavior across requests. One machine claimed to represent several unrelated AI providers within seconds, while the scanner cycled evenly through all 32 identities.

Fake Claude identities also reused Anthropic’s crawler contact address, even when claiming to represent a different Claude agent. Shared infrastructure and technical fingerprints connected the activity across targets.

Why Identity Verification Matters More Than IP Blocklists

Infrastructure turnover made address-based defenses difficult. The actor used more than 300 cloud addresses in one day and nearly 400 during one week.

None of the addresses observed in late September appeared again a month later. External threat feeds flagged many addresses during their use, but the scanner had usually moved elsewhere by then.

This campaign involves outsiders pretending to be agents, unlike AI agent credential exposure caused by legitimate tools handling secrets during routine work.

Both problems make identity and access controls important, but they require different investigations: defenders must distinguish forged visitors from genuine agents whose permissions or data handling create risk.

The scanner also distorted traffic measurements. At several organizations, it generated more than 80% of requests labeled as AI bot traffic.

That does not mean genuine AI services launched the attacks; it shows how trusting a visitor’s self-description can turn malicious scanning into apparently legitimate activity in security dashboards.

Cequence recommends verifying agents through signed requests, published address ranges, or direct integrations. Teams should also inspect behavior, particularly requests for credential files, and keep secrets, staging systems, and administration sites away from public access.

Broader AI agent identity controls address ownership and permissions, but a familiar bot name alone should never justify access.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys appeared first on Cyber Security News.