Imposter abused trust in OpenAI, Anthropic, and 30 others to hunt for secrets

Attackers are impersonating AI agents from companies including OpenAI, Anthropic, and Meta in a bid to trick organizations into exposing sensitive credentials, according to researchers who observed a single threat actor cycling through dozens of fake bot identities while probing enterprise web servers for secrets. A single threat actor was seen posing as approximately 32 AI bots, while probing organizations across multiple industries. Sought files included those used to store passwords, API keys, and cloud credentials. A malicious scanner used by the attacker ran from an unnamed major cloud provider. “It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths,” Cequence’s director of threat research, Will…

First reported by CSO Online. This page is a short excerpt; the full text is theirs.