# Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys

> Cequence's CQ Prime Research tracked a single actor, operating from a major cloud provider, that impersonated about 32 AI bot identities (OpenAI, Anthropic, Perplexity, Meta and others) from late September through late October 2026. It probed roughly 90 paths for .env files, cloud credential files and private SSH keys while rotating 300+ cloud IP addresses per day.

- **Published:** 2026-11-02T11:15:59Z
- **Last reviewed:** 2026-11-02T11:15:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5047
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5047.png
- **ID:** TL-2026-5047
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

Cequence Security's threat research arm (CQ Prime Research, reported by Will Glazier, Director of Threat Research) documented a single actor that disguised a credential-hunting scanner as AI crawlers and assistants. The scanner cycled evenly through approximately 32 self-reported AI bot identities, including identities claiming to be from OpenAI (ChatGPT), Anthropic (Claude), Perplexity and Meta. A single machine was observed claiming to be agents from OpenAI, Anthropic, Meta and Perplexity within seconds of one another, and a copied-and-pasted Anthropic crawler contact address was reused across different fake Claude identities. Genuine bots do not distribute traffic evenly across unrelated vendor identities, which is the primary behavioral tell.

Operationally, the actor worked around the clock against one organization at a time, sending bursts of 50 to 190 requests in about 8 seconds before moving to the next target. It first requested random, nonsensical paths to find catch-all web servers that answer any URL (so that later 200 responses can be distinguished or false positives filtered), then requested a list of roughly 90 specific paths. Reported targets were .env configuration files, cloud credential files, private SSH keys, server environment data and Git metadata. Secondary reporting states that nearly all requests were blocked or failed and no breach was reported by the source.

Infrastructure: traffic came from a major cloud provider (not named in the source). The actor used 300+ cloud addresses in a single day and nearly 400 over a week; no address seen in late September reappeared a month later, and third-party threat feeds flagged many addresses only after the actor had moved on, so static IP blocklists decay within days. On one October day the actor reached 48% of Cequence-protected organizations that saw any AI bot traffic, and at several organizations it generated more than 80% of requests labeled as AI bot traffic. Affected sectors were financial services, retail, telecommunications, energy and software. The primary Cequence report is dated 2026-10-28. No specific IP, domain or hash values were published, so no BeaconBeagle lookup was possible; no CVE is associated.

Related but separately reported (not attributed to this actor by the sources): GreyNoise documented forged AI-crawler traffic (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended) from 824 IPs between 2026-07-28 and 2026-08-23 requesting /.env variants, /.aws/credentials and /.git/config, with zero /robots.txt requests; Fastly's single-day analysis of 2026-09-23 found 6.3 million requests claiming AI bot identity from nearly 10,200 IPs (the ~10,200 figure belongs to Fastly, not Cequence), ~94% of it from about 1,600 addresses on one cloud provider. These corroborate the technique and path set but are kept as context, not as the same campaign.

Defensive takeaway: self-reported User-Agent strings are not identity. Verify AI crawlers by published IP ranges, signed requests or direct integrations, apply behavior-based bot management (credential-file requests, multi-vendor identities from one source, no robots.txt fetch, burst rates), and ensure secrets, staging systems and admin sites are never publicly reachable.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1595.003 Wordlist Scanning
- T1583.003 Virtual Private Server
- T1036 Masquerading
- T1190 Exploit Public-Facing Application
- T1552.001 Credentials In Files
- T1552.004 Private Keys

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5047 Secret-File Probing (.env, .aws/credentials, .git/config, SSH keys) Behind Forged AI-Bot Identity** (`TL-2026-5047-SPL-001`)

Detects a single client requesting multiple credential-bearing paths (/.env and variants, /.aws/credentials, /.git/config, private SSH keys, Vite /@fs/ .env reads) within 10 minutes, or any secret-path request that carries a self-declared AI crawler User-Agent (GPTBot, ClaudeBot, PerplexityBot, meta-externalagent and others). Matches the Cequence CQ Prime ~90-path credential hunt in TL-2026-5047 where an unattributed actor disguised a scanner as ~32 AI bot identities. Behaviour-first: it fires on the path pattern itself, so it still works when the User-Agent is novel and when source IPs rotate daily.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1595.002, T1595.003, T1592.004, T1552.001, T1552.004
- **Data sources:** web_access_logs, index=web sourcetype=access_combined, W3CIISLog, sigma:webserver
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

````spl
index=web sourcetype=access_combined earliest=-24h
```TL-2026-5047: secret-file hunting (.env, .aws/credentials, .git/config, SSH keys), often behind a forged AI-crawler User-Agent```
| eval path=lower(coalesce(uri_path, uri))
| where match(path, "(^|/)[.]env([._-][a-z0-9_.-]+)?$|/[.]aws/credentials$|/[.]git/config$|/[.]ssh/id_(rsa|ed25519|ecdsa|dsa)$|/id_(rsa|ed25519)$|^/@fs/.*[.]env") AND NOT match(path, "[.]env[._-](example|sample|dist|template)$")
| eval ai_claim=if(match(lower(useragent), "gptbot|chatgpt-user|oai-searchbot|claudebot|claude-user|claude-searchbot|anthropic-ai|perplexitybot|perplexity-user|meta-externalagent|meta-externalfetcher|facebookbot|google-extended|ccbot|bytespider|amazonbot"), 1, 0)
| bin _time span=10m
| stats count AS requests dc(path) AS distinct_secret_paths values(path) AS secret_paths sum(ai_claim) AS ai_claim_requests values(status) AS statuses values(useragent) AS user_agents by _time clientip
| where distinct_secret_paths>=3 OR (ai_claim_requests>0 AND requests>=2)
| sort - distinct_secret_paths
````

### Microsoft KQL

```kql
let SecretPath = @'(?i)(^|/)[.]env([._-][a-z0-9_.-]+)?$|/[.]aws/credentials$|/[.]git/config$|/[.]ssh/id_(rsa|ed25519|ecdsa|dsa)$|/id_(rsa|ed25519)$|^/@fs/.*[.]env';
let SecretExclude = @'(?i)[.]env[._-](example|sample|dist|template)$';
let AiUa = @'(?i)gptbot|chatgpt-user|oai-searchbot|claudebot|claude-user|claude-searchbot|anthropic-ai|perplexitybot|perplexity-user|meta-externalagent|meta-externalfetcher|facebookbot|google-extended|ccbot|bytespider|amazonbot';
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem matches regex SecretPath
| where csUriStem !matches regex SecretExclude
| extend AiClaim = iff(csUserAgent matches regex AiUa, 1, 0)
| summarize Requests = count(), DistinctSecretPaths = dcount(csUriStem), SecretPaths = make_set(csUriStem, 25), AiClaimRequests = sum(AiClaim), Statuses = make_set(scStatus), UserAgents = make_set(csUserAgent, 5) by cIP, bin(TimeGenerated, 10m)
| where DistinctSecretPaths >= 3 or (AiClaimRequests > 0 and Requests >= 2)
| project TimeGenerated, cIP, Requests, DistinctSecretPaths, SecretPaths, AiClaimRequests, Statuses, UserAgents
| order by DistinctSecretPaths desc
```

### Sigma

```yaml
title: Credential File Probing by Self-Declared AI Crawler (TL-2026-5047)
id: 3b8e2f64-5a1c-4d7e-9c0a-6f1d2e8b7a41
status: experimental
description: Detects web requests for .env files, cloud credential files, Git metadata or private SSH keys sent with a User-Agent claiming to be an AI crawler (OpenAI, Anthropic, Perplexity, Meta and others). Genuine AI crawlers do not request these paths. Observed in the Cequence CQ Prime campaign reported 2026-10-28 (TL-2026-5047).
references:
  - https://www.cequence.ai/blog/ai-agent-impersonation
  - https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.t1595.003
  - attack.credential-access
  - attack.t1552.001
  - attack.t1552.004
  - attack.t1592.004
logsource:
  category: webserver
detection:
  selection_path:
    c-uri|re: '(?i)(^|/)[.]env([._-][a-z0-9_.-]+)?([?].*)?$|/[.]aws/credentials([?].*)?$|/[.]git/config([?].*)?$|/[.]ssh/id_(rsa|ed25519|ecdsa|dsa)([?].*)?$|/id_(rsa|ed25519)([?].*)?$|^/@fs/.*[.]env'
  selection_ua:
    cs-user-agent|contains:
      - 'GPTBot'
      - 'ChatGPT-User'
      - 'OAI-SearchBot'
      - 'ClaudeBot'
      - 'Claude-User'
      - 'Claude-SearchBot'
      - 'anthropic-ai'
      - 'PerplexityBot'
      - 'Perplexity-User'
      - 'meta-externalagent'
      - 'meta-externalfetcher'
      - 'FacebookBot'
      - 'Google-Extended'
      - 'CCBot'
      - 'Bytespider'
      - 'Amazonbot'
  filter_template:
    c-uri|re: '(?i)[.]env[._-](example|sample|dist|template)([?].*)?$'
  condition: selection_path and selection_ua and not filter_template
falsepositives:
  - Security scanners or red-team tooling that deliberately sets an AI-crawler User-Agent
  - Internal vulnerability assessment of web roots
level: high
```

**Known false positives:**

- Authorized vulnerability scanners and pentest tools requesting dotfile paths
- Developers or monitoring probes checking that /.env returns 403/404
- Requests for template files such as .env.example (excluded by default, extend the exclusion list for your stack)

**Tuning notes:** Change index/sourcetype to match your web tier (nginx:plus:access, iis, WAF logs). Allowlist scanner source ranges by clientip. Raise distinct_secret_paths if noisy, lower it to 2 for high-value apps. Source IPs rotate 300+ per day, so do not add attacker IPs to a static blocklist; alert on the path and identity behaviour instead.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5047 Sentinel: Secret-File Probing Behind Forged AI-Bot Identity (locked: unlock with TL Creds)
- TL-2026-5047 Sentinel: Successful Retrieval of Secret Files (locked: unlock with TL Creds)
- TL-2026-5047 Sentinel: Single Source Claiming Multiple AI Vendor Identities or Bursting Without robots.txt (locked: unlock with TL Creds)
- TL-2026-5047 Sigma: Credential File Probing by Self-Declared AI Crawler (locked: unlock with TL Creds)
- TL-2026-5047 Sigma: Successful Response for Secret File Request (locked: unlock with TL Creds)
- TL-2026-5047 Sigma: Single Source Rotating Through Multiple AI Crawler Identities (locked: unlock with TL Creds)
- TL-2026-5047 Successful Retrieval of Secret Files (.env, .aws/credentials, .git/config, SSH Keys) (locked: unlock with TL Creds)
- TL-2026-5047 Single Source Claiming Multiple AI Vendor Identities or Bursting Without robots.txt (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys](https://cybersecuritynews.com/hackers-impersonate-ai-bots/)
- [Cequence: AI Agent Impersonation (CQ Prime Research)](https://www.cequence.ai/blog/ai-agent-impersonation)
- [CSO Online: Imposter abused trust in OpenAI, Anthropic and 30 others to hunt for secrets](https://csoonline.com/article/4242088/imposter-abused-trust-in-openai-anthropic-and-30-others-to-hunt-for-secrets.html)
- [Hackread: Hackers Impersonate 32 AI Bots to Hunt for Exposed Credentials](https://hackread.com/hackers-impersonate-ai-bots-hunt-exposed-credentials/)
- [Let's Data Science: Cequence Reports Scanner Posing as 32 AI Bots Hunting Credentials](https://letsdatascience.com/news/cequence-reports-scanner-posing-as-32-ai-bots-hunting-creden-467d0948)
- [GreyNoise: Threat actors posing as AI crawlers (related, separate campaign)](https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers)
- [Fastly: AI Bot Cosplay (related, separate analysis of 2026-09-23)](https://www.fastly.com/blog/ai-bot-cosplay)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5047