Attackers Impersonate AI Bots to Scan for Exposed Credentials
A threat actor is conducting credential harvesting campaigns by masquerading as legitimate AI crawlers from OpenAI, Anthropic, Meta, and other major AI providers. By spoofing AI bot user agents, the attacker blends reconnaissance traffic into normal AI platform activity, reducing the likelihood of detection. This technique exploits the growing trust organisations extend to AI service traffic, exposing sensitive data to unauthorised access.