Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

Source: NicoElNino via Adobe Stock Photo

A threat actor, or cybercriminal, hid behind more than 30 different AI bots to search for exposed login details and steal them. The attacker kept scanning for sensitive information but did not succeed. The findings show a growing problem for organizations: they must tell the difference between AI agents that are allowed to access their networks and those that may be harmful.

A scanner pretended to be 32 different bots, including web crawlers and AI assistants from OpenAI, Anthropic, Perplexity, Meta, and other companies. It searched for exposed login details belonging to different organizations, according to a report published today by CQ Prime Research, part of Cequence Security. The scanner requested files from organizations in retail, financial services, telecommunications, energy, and software. These files can contain passwords, API keys, and cloud login details.

The scanner had been running since late September and was still active in late October, the researchers said. They found the activity on Oct. 21. On one day that month, 48% of organizations protected by Cequence received traffic from the harmful AI bot.

The findings show a growing challenge for security teams. Businesses must decide which AI agents they can trust and allow to access their services.

"Attackers can test every one of those allow and deny decisions, and Cequence is seeing them probe which agents a business trusts, then impersonate the agents they expect to get through," Will Glazier, director of CQ Prime threat research and data science, wrote in the report.

Malicious Scanner Gives Itself Away

The scanner sends a burst of 50 to 190 requests in about 8 seconds, then moves to the next target. It works through targets one at a time, day and night. Fortunately, nearly all of its requests were blocked or failed, according to the report.

"It sends random nonsense paths first to find websites that answer every request, a common scanning technique," Glazier wrote.

CQ Prime Research identified the traffic as harmful because the scanner behaved in ways that made it stand out from normal traffic. It switched evenly between about 32 different bot identities. According to the report, real bots do not behave this way. One machine claimed to be an agent from OpenAI, Anthropic, Meta, and Perplexity, all within seconds.

The attacker also used Anthropic's crawler contact address for every fake version of its Claude bots, even when pretending to be different Claude agents. CQ Prime Research said this showed that the text had been copied rather than written specifically for each agent.

The scanner also requested configuration files, cloud credential files, and private SSH keys. It used a list of about 90 file paths and never identified itself or provided a contact address. Legitimate services that scan the Internet would not need these files and always identify themselves.

"The requests gave it away," said Collin Hogue-Spears, senior director of solutions management at security firm Black Duck. This means that "what Cequence documented is the test, not a breach."

Financial Accounts at Risk

But what happens when AI agents scanning a network get through? This is a growing concern for organizations, especially banks and other financial institutions. Experts worry that harmful agents may already be logging in to customer accounts without the organizations knowing. Such activity could cause economic problems around the world.

For now, CQ Prime Research found that at financial services companies, AI agents acting on behalf of customers made up fewer than 1 in 4,000 requests. "The agents banks worry about most log in with a customer's own credentials through an ordinary browser and don't announce themselves," Glazier wrote in the report.

Financial institutions should now be taking steps to identify which AI agents are legitimate and which are not. But Shane Barney, chief information security officer at Keeper Security, says that starting now may mean they are already behind the attackers.

"Banks are currently scrambling to figure out which AI bots belong on their networks, but cybercriminals have already moved on to the next phase," he says. "They are no longer trying to break into these systems. Instead, they are simply logging in disguised as trusted AI agents."

Defending Against AI Agent Impersonation

Barney says security leaders should manage AI agents, API keys, and service accounts as carefully as they manage human administrators to reduce the growing threat from AI bots and agents. "That requires eliminating implicit trust across every access path," he says.

CQ Prime Research also says organizations should not trust a bot just because it claims to have a certain identity. They should check that agents are genuine by verifying signed requests, checking published ranges of network addresses, or using direct integrations.

Organizations should also watch for behavior that does not match an agent's claimed identity. For example, Glazier wrote, this could include an AI assistant requesting configuration files or files containing login details.

Organizations should also stop storing static credentials in vulnerable files where scanning bots can easily find them. This would close obvious security gaps. Instead, Barney says, "Security teams must move away from long-lived local credentials in favor of centralized, zero-knowledge secrets vaults."

About the Author