Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI Crawlers to Harvest Credentials and Secrets — Threadlinqs Intelligence
As of 2026-08-29, Threat Actors Impersonate OpenAI, Anthropic, and DeepSeek AI Crawlers to Harvest Credentials and Secrets is a medium-severity threat intel threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-2204 · Severity: MEDIUM · Status: ACTIVE · Category: THREAT_INTEL
GreyNoise identified 824 IP addresses across 795 /24 networks sending forged AI-crawler user-agent strings (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, PerplexityBot) between July
Between July 28 and August 23, 2026, GreyNoise observed a cluster of 824 addresses spread across 795 distinct /24 networks sending HTTP requests bearing six forged AI-crawler user-agent strings — ClaudeBot (Anthropic), GPTBot, ChatGPT-User, and OAI-SearchBot (OpenAI), Google-Extended (Google), and PerplexityBot (Perplexity) — along with forged Amazon crawler variants observed in higher volume. Every one of the six primary names arrived in near-identical volume behind a single shared HTTP client fingerprint, which GreyNoise used JA4+ fingerprinting to cluster and unmask as one coordinated scanning operation rather than six unrelated bots.
Two behavioral signals distinguished the traffic from legitimate crawler activity. First, none of the 824 addresses matched any address in the four companies' officially published crawler IP-range lists (Anthropic's claude.com/crawling/bots.json, OpenAI's gptbot.json/chatgpt-user.json/searchbot.json, Google's published crawling IP ranges, and Perplexity's perplexitybot.json/perplexity-user.json) — every address was checked against every list and none matched. Second, a genuine crawler requests /robots.txt before crawling; GreyNoise's own telemetry shows the real Anthropic ClaudeBot requests /robots.txt in roughly 12% of its traffic, while the forged cluster never requested it once across the full collection window. Google-Extended alone accounted for 263,849 forged sessions, notable because Google documents that Google-Extended has no separate published user-agent string to spoof in the first place.
The forged traffic specifically targeted credential- and secret-bearing paths: /.env and its common variants (/.env.local, /.env.production, /.env.old, /.env.bak, /.env.swp), /app/.env, /api/.env, /.aws/credentials, /.git/config, and local password stores. GreyNoise's supplemental dataset classifies 806 of the 824 addresses as malicious and 18 as unknown, with none classified benign, though the top-volume addresses observed (e.g., 136.110.54.83, 35.204.220.189, 136.66.71.144, 34.62.67.70, 34.125.245.56) sit in cloud-tenant (hyperscaler) address space, which GreyNoise flags for verification before blocking given how frequently such ranges are reassigned between tenants.
GreyNoise separately calls out CVE-2025-30208, a Vite dev-server arbitrary file disclosure in which appending ?raw?? or ?import&raw?? to a request bypasses the @fs access-control check, as a related exposure vector: an internet-facing Vite dev server left unpatched compounds the risk of exactly the kind of credential-file harvesting this campaign is attempting. GreyNoise is explicit that its telemetry shows only requests arriving, not outcomes — "nothing here says a file was returned or that any organization was affected" — and reports no confirmed compromises tied to this activity as of publication. No threat-actor attribution is offered.
Weaknesses (CWE)
CWE-200, CWE-284
Timeline
- CVE-2025-30208 (Vite @fs access-control bypass via ?raw?? / ?import&raw?? query suffixes; CVSS 3.1 5.3, CWE-200/CWE-284) is publicly disclosed via GHSA-x574-m823-4x7w and patched in Vite 4.5.10, 5.4.15, 6.0.12, 6.1.2, and 6.2.3; later cited by GreyNoise as a related exposure vector for internet-facing Vite dev servers.
- GreyNoise's JA4+ historical trend analysis of the impostor HTTP client fingerprint ('ge11nn05enus_f3bb7a...') extends back roughly 90 days from the August 23 close of the campaign window, over which the same client generated more than 1,500 distinct user-agent strings predating the credential-targeting focus documented in the campaign.
- GreyNoise first observes forged AI-crawler user-agent traffic (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended, PerplexityBot) requesting credential and secrets paths from addresses outside each vendor's published IP ranges.
- Forged AI-crawler scanning activity continues through the close of the July 28-August 23 collection window analyzed by GreyNoise.
- Forged AI-crawler traffic reaches its highest observed volume on the final day of GreyNoise's collection window, coinciding with the close of the 824-address dataset.
- GreyNoise publishes a supplemental dataset (a stated 'complete enumeration', not a sample) of 824 offending addresses across 795 /24 networks with per-IP session counts, classifying 806 as malicious and 18 as unknown, with none classified benign; most entries carry 'cloud-tenant-address-verify-before-denying' and/or 'shared-egress-do-not-block' handling tags.
- GreyNoise publishes 'Threat Actors Are Posing as OpenAI, Anthropic and DeepSeek to Target Credentials and Secrets,' detailing the JA4+ fingerprint cluster, targeted file paths, and detection guidance; reports no confirmed compromises to date.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
THREAT_INTEL, MEDIUM, threat intelligence, cybersecurity, CVE-2025-30208, T1595, T1595.002, T1595.003, T1583.006, T1588.006, T1036, T1036.005, T1190, T1552.001, T1555
