Attackers impersonate ChatGPT, Claude and Perplexity bots to hunt for exposed credentials
THREAT ACTORChatGPTredteam/daily · 2 sources
- Severity
- Medium
- Sources
- 2
What happened
A single actor was observed rotating through roughly 32 spoofed AI bot user agents, including ChatGPT, Claude and Perplexity, to probe enterprise websites for exposed passwords, API keys and cloud credentials. Cequence reported that on one October day the campaign reached 48% of its protected organisations that received any traffic. The article provides no CVE identifiers or affected product versions. Defenders should validate bot traffic by IP or verified signatures rather than user-agent strings, and scan web content and repositories for exposed secrets.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Do not trust user-agent strings alone; verify AI crawler traffic against published IP ranges or signatures.
- Scan public-facing websites and their source code for exposed passwords, API keys and cloud credentials.
- Rotate any credentials found to be exposed and restrict access to sensitive endpoints.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
GBHackersCyber Security News