Attacker Impersonates 32 AI Bots to Hunt for Credentials

An attacker impersonated 32 distinct AI bots while scanning for passwords, API keys, and cloud credentials, according to research from Cequence. The activity shows how automated threats can disguise themselves as legitimate machine agents to probe infrastructure without raising immediate suspicion.

The campaign targeted organizations across multiple sectors, including healthcare, insurance, legal, IT and development, and operations. By presenting as a range of AI bot identities, the attacker attempted to blend into environments where automated traffic is increasingly common and often trusted by default.

Cequence recommends that organizations authenticate automated agents and evaluate traffic based on behavioral patterns rather than relying on claimed bot identities. Accepting a bot’s self-declared identity without verification creates a gap that adversaries can exploit to harvest sensitive credentials.