Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI Crawlers to Harvest Credentials and Secrets

Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI (TL-2026-2204) is a medium-severity tracked intrusion set, first published 2026-08-29. It has no confirmed attribution, affects vitejs Vite dev server, references 1 CVE (CVE-2025-30208), maps to 11 MITRE ATT&CK techniques (T1005, T1036, T1036.005), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-2204

Threat ID
TL-2026-2204
Severity
MEDIUM
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-08-29
Last reviewed
2026-08-29
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
17

GreyNoise identified 824 IP addresses across 795 /24 networks sending forged AI-crawler user-agent strings (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, PerplexityBot) between July 28 and August 23, 2026 to probe internet-facing servers for .env files, AWS credentials, .git/config, and password stores. None of the traffic originated from the vendors' published crawler IP ranges and none of it requested /robots.txt first, the behavioral tell that separated it from genuine crawler traffic. No confirmed compromises have been reported.

How Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI works

Between July 28 and August 23, 2026, GreyNoise observed a cluster of 824 addresses spread across 795 distinct /24 networks sending HTTP requests bearing six forged AI-crawler user-agent strings — ClaudeBot (Anthropic), GPTBot, ChatGPT-User, and OAI-SearchBot (OpenAI), Google-Extended (Google), and PerplexityBot (Perplexity) — along with forged Amazon crawler variants observed in higher volume. Every one of the six primary names arrived in near-identical volume behind a single shared HTTP client fingerprint, which GreyNoise used JA4+ fingerprinting to cluster and unmask as one coordinated scanning operation rather than six unrelated bots.

Two behavioral signals distinguished the traffic from legitimate crawler activity. First, none of the 824 addresses matched any address in the four companies' officially published crawler IP-range lists (Anthropic's claude.com/crawling/bots.json, OpenAI's gptbot.json/chatgpt-user.json/searchbot.json, Google's published crawling IP ranges, and Perplexity's perplexitybot.json/perplexity-user.json) — every address was checked against every list and none matched. Second, a genuine crawler requests /robots.txt before crawling; GreyNoise's own telemetry shows the real Anthropic ClaudeBot requests /robots.txt in roughly 12% of its traffic, while the forged cluster never requested it once across the full collection window. Google-Extended alone accounted for 263,849 forged sessions, notable because Google documents that Google-Extended has no separate published user-agent string to spoof in the first place.

The forged traffic specifically targeted credential- and secret-bearing paths: /.env and its common variants (/.env.local, /.env.production, /.env.old, /.env.bak, /.env.swp), /app/.env, /api/.env, /.aws/credentials, /.git/config, and local password stores. GreyNoise's supplemental dataset classifies 806 of the 824 addresses as malicious and 18 as unknown, with none classified benign, though the top-volume addresses observed (e.g., 136.110.54.83, 35.204.220.189, 136.66.71.144, 34.62.67.70, 34.125.245.56) sit in cloud-tenant (hyperscaler) address space, which GreyNoise flags for verification before blocking given how frequently such ranges are reassigned between tenants.

GreyNoise separately calls out CVE-2025-30208, a Vite dev-server arbitrary file disclosure in which appending ?raw?? or ?import&raw?? to a request bypasses the @fs access-control check, as a related exposure vector: an internet-facing Vite dev server left unpatched compounds the risk of exactly the kind of credential-file harvesting this campaign is attempting. GreyNoise is explicit that its telemetry shows only requests arriving, not outcomes — "nothing here says a file was returned or that any organization was affected" — and reports no confirmed compromises tied to this activity as of publication. No threat-actor attribution is offered.

MITRE ATT&CK techniques used in TL-2026-2204

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1555 Credentials from Password Stores

Resource Development

T1583.006 Acquire Infrastructure: Web Services; T1588.006 Vulnerabilities

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning; T1595.003 Active Scanning: Wordlist Scanning

Affected products and versions in Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI

  • vitejs — Vite dev server
    Vulnerable versions: <4.5.10; 5.0.0-<5.4.15; 6.0.0-<6.0.12; 6.1.0-<6.1.2; 6.2.0-<6.2.3
    Fixed in: 4.5.10; 5.4.15; 6.0.12; 6.1.2; 6.2.3
  • Generic — Internet-facing web servers with credential/secret files reachable under the web root (.env, .aws/credentials, .git/config, password stores)
    Vulnerable versions: N/A - configuration issue, not a versioned product
    Fixed in: N/A - remediated by relocating files outside web root and rotating exposed credentials

Remediation for Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI

Patches

  • Upgrade Vite to 4.5.10, 5.4.15, 6.0.12, 6.1.2, or 6.2.3 (or later) to remediate CVE-2025-30208

Immediate actions

  • Alert and/or block on any request for /.env* variants, /.aws/credentials, /.git/config, or other credential-bearing paths regardless of the claimed crawler identity in the user-agent header
  • Validate the source IP of any request claiming to be ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, or PerplexityBot against each vendor's published address list before granting crawler-specific access or bypassing controls
  • Flag any purported AI-crawler user agent that has not requested /robots.txt across multiple days of traffic as a probable impersonator

Workarounds

  • Never expose a Vite dev server directly to the network or internet; bind it to localhost or place it behind authenticated access

Longer-term hardening

  • Relocate .env, .git, and cloud-credential files outside the web root on all internet-facing servers
  • Rotate any cloud access keys, database passwords, or API tokens that were ever reachable via a web-exposed path
  • Establish an owned, regularly refreshed inventory of vendor crawler IP-range lists (Anthropic, OpenAI, Google, Perplexity, Amazon) for automated validation at the edge/WAF layer

CVEs associated with Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI

CVE-2025-30208

Weaknesses (CWE) in Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI

CWE-200, CWE-284

Timeline of Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI

  • CVE-2025-30208 (Vite @fs access-control bypass via ?raw?? / ?import&raw?? query suffixes; CVSS 3.1 5.3, CWE-200/CWE-284) is publicly disclosed via GHSA-x574-m823-4x7w and patched in Vite 4.5.10, 5.4.15, 6.0.12, 6.1.2, and 6.2.3; later cited by GreyNoise as a related exposure vector for internet-facing Vite dev servers.
  • GreyNoise's JA4+ historical trend analysis of the impostor HTTP client fingerprint ('ge11nn05enus_f3bb7a...') extends back roughly 90 days from the August 23 close of the campaign window, over which the same client generated more than 1,500 distinct user-agent strings predating the credential-targeting focus documented in the campaign.
  • GreyNoise first observes forged AI-crawler user-agent traffic (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, PerplexityBot) requesting credential and secrets paths from addresses outside each vendor's published IP ranges.
  • Forged AI-crawler traffic reaches its highest observed volume on the final day of GreyNoise's collection window, coinciding with the close of the 824-address dataset.
  • Forged AI-crawler scanning activity continues through the close of the July 28-August 23 collection window analyzed by GreyNoise.
  • GreyNoise publishes a supplemental dataset (a stated 'complete enumeration', not a sample) of 824 offending addresses across 795 /24 networks with per-IP session counts, classifying 806 as malicious and 18 as unknown, with none classified benign; most entries carry 'cloud-tenant-address-verify-before-denying' and/or 'shared-egress-do-not-block' handling tags.
  • GreyNoise publishes 'Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets,' detailing the JA4+ fingerprint cluster, targeted file paths, and detection guidance; reports no confirmed compromises to date.

Sources cited for Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI

More in threat intel

Detection coverage for TL-2026-2204

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2204 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats