Threat Actors Impersonate AI Crawlers to Exfiltrate Sensitive Credentials

GreyNoise has identified a campaign involving automated scanners impersonating legitimate AI crawlers, including those from OpenAI, Anthropic, and DeepSeek. These actors use forged User-Agent strings - matching character-for-character with known crawlers like ClaudeBot - to bypass simple access controls that rely solely on the User-Agent header. Unlike legitimate bots, these scanners do not request /robots.txt files and originate from IP addresses that do not match the published IP ranges of the impersonated organizations.

The attackers specifically target sensitive configuration files and credentials, including .env files, cloud access keys, private keys, and password stores. This activity also includes attempts to exploit CVE-2025-30208 in Vite, an arbitrary file disclosure vulnerability. The scale of this campaign is significant, involving hundreds of distinct IP addresses spread across different network ranges, indicating a distributed and highly automated infrastructure. Defenders should transition from User-Agent-based allowlisting to a model that validates both the identity and the source IP address of incoming crawler requests.

Attack Chain

1. Attacker reconnaissance phase identifies misconfigured web servers hosting sensitive files like .env or .git configurations.
2. Attacker crafts HTTP requests using forged User-Agent headers mimicking legitimate AI crawlers (e.g., Anthropic's ClaudeBot or OpenAI's GPTBot).
3. Attacker directs traffic from a distributed set of IP addresses (outside of legitimate provider ranges) toward target web servers.
4. Attacker attempts to bypass basic access controls that rely solely on string-matching the User-Agent header.
5. Attacker probes for known sensitive paths (e.g., /.env, /.aws/credentials) and attempts to exploit known vulnerabilities like CVE-2025-30208.
6. Attacker exfiltrates sensitive secrets and environment variables if the server returns valid file contents.

Impact

Successful exploitation allows attackers to gain unauthorized access to critical infrastructure secrets, including cloud access keys, database credentials, and API tokens. This exposure can lead to lateral movement, data exfiltration, or complete takeover of cloud environments. The campaign targets a wide range of web platforms, and the automated nature suggests high-volume, opportunistic harvesting of credentials from any misconfigured internet-facing server.

Recommendation

1. Audit all web access controls that rely solely on User-Agent strings; replace them with strict allowlists that validate the connecting IP address against the official JSON manifests provided by OpenAI, Anthropic, Amazon, and Google.
2. Deploy detections for requests to sensitive files (e.g., /.env, /.aws/credentials, /.git/config) coming from non-standard or unexpected client IP addresses.
3. Implement a log-based check to identify crawlers that never request /robots.txt, which is a strong indicator of non-benign bot activity.
4. Patch all Vite instances to version 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10 to remediate CVE-2025-30208.
5. Rotate all cloud access keys and API tokens that were hosted in the web root or potentially reachable via HTTP requests.