Hackers Pose as OpenAI, Anthropic and DeepSeek to Steal Credentials and Secrets
Brief
Threat actors are impersonating web crawlers from OpenAI, Anthropic, DeepSeek , and other major organizations to scan websites for exposed credentials and sensitive configuration files, targeting misconfigured servers that may leak cloud keys, API tokens, passwords, and private keys.
GreyNoise observed a broader cluster using 13 AI crawler identities from eight companies. The scanners requested files such as . env, /. aws/credentials, private key locations, and password stores. An . env file commonly contains application secrets, including database passwords, cloud access keys, and API tokens.
The campaign relies on a simple but effective deception technique: forging the HTTP User-Agent header. Web crawlers identify themselves through this header, such as Googlebot, ClaudeBot, or GPTBot. However, the header is supplied by the client.