Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCmediumExploited in the wild

Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets

GreyNoise ()3
Read at greynoise.io
AI summary · glm-5.3-flashSummaries by Vani AI

GreyNoise observes scanners spoofing OpenAI, Anthropic, and DeepSeek crawler user agents to hunt leaked credentials and secrets.

GreyNoise is observing automated scanners that pose as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies. The scanners use forged user agents while requesting files where misconfigured web servers frequently leak secrets and credentials. This activity abuses trust in AI crawler traffic to discover exposed credentials for follow-on attacks.

Key facts
  • Scanners forge user agents of OpenAI, Anthropic, DeepSeek, and Fortune 500 crawlers
  • Targets files where misconfigured web servers leak secrets and credentials
  • Observed activity tracked by GreyNoise
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
anthropiccredential-accessdeepseekgreynoiseopenaiscanningsecret-exposureuser-agent-spoofing
Vendors
GreyNoiseOpenAIAnthropicDeepSeek

From the original article

GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured web servers frequently leak secrets and credentials.

GreyNoise

greynoise.io

Read the full article at GreyNoise

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.