Scanners impersonate ChatGPT, Claude and Perplexity to hunt credentials
Original title: Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys
Cequence says one actor rotated about 32 bot identities and sought secrets; it does not confirm theft.
Cequence researchers say a single actor impersonated about 32 AI bots, including ChatGPT, Claude, and Perplexity, while scanning sites for passwords, API keys, cloud credentials, SSH keys, and environment files. The scanner, run from a major cloud provider, hit financial services, retail, telecommunications, energy, and software targets from at least late September through late October. Cequence reports credential-seeking activity, not confirmed theft or later compromise.
Unconfirmed: Cequence links the scans to one actor but does not confirm any theft or compromise.
- On one October day the actor reached 48% of protected organizations receiving AI bot traffic.
- Each address sent 50 to 190 requests in about eight seconds.
- Researchers saw roughly 90 targeted file paths, including .env files.
- More than 300 cloud addresses were used in one day and nearly 400 in a week.
- At some organizations the scanner made more than 80% of labeled AI bot requests.
Impact: Sought passwords, API keys, SSH keys and cloud credentials
- 1.Verify claimed AI bots with signed requests, published ranges, or direct integrations.
- 2.Inspect requests for credential and environment files.
- 3.Keep secrets, staging systems, and admin sites off public access.
- Organizations
- Cequence
- AI models
- ChatGPTClaudePerplexity
From the original article
3 min read at cybersecuritynews.com
Hackers are posing as trusted artificial intelligence bots to search websites for passwords, API keys, and cloud credentials. The campaign uses the names of ChatGPT, Claude, Perplexity, and other AI services to disguise automated scanning, testing whether businesses will let requests through simply because they appear to come from a familiar provider. The operation highlights […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.