Threat Actors Are Posing as OpenAI, Anthropic and Deep Seek to Target Credentials and Secrets
Summary: GreyNoise observed automated scanners forging the crawler names of OpenAI, Anthropic, DeepSeek and Fortune 500 companies while requesting .env files, cloud access keys, private keys and password stores. A cluster impersonating 13 AI crawlers from eight companies sent six names from the same 824 addresses in near-identical volume, never once requesting /robots.txt, and all 263,849 sessions carrying the Google-Extended string were forged because Google documents no such user agent.
What's compelling: Not one of the 824 addresses matched any published crawler range from the four companies, and they sit across 795 separate /24 networks, so there is no single network to block and the user agent label cannot separate them from Anthropic's real crawler, which sent the identical ClaudeBot string.
Read the original at GreyNoise Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026