Attackers Spoof ChatGPT, DeepSeek and Other AI Bots to Target Russian Websites
Threat actors are impersonating popular generative AI assistants by forging User-Agent strings to bypass security controls on Russian web applications. Solar WAF observed the first such requests on 12 August 2026 using the DeepSeekBot identifier, with additional spoofed agents from ChatGPT, Perplexity, Claude and Grok appearing from 27 August. The campaign focuses on small and medium-sized businesses as well as larger corporations. Attackers rely on the growing trust that site owners place in AI crawlers, applying relaxed filtering rules to traffic that appears to originate from legitimate AI services. In 53 percent of detected cases the requests attempted DNS Rebinding attacks aimed at internal resources, while 12 percent sought data exfiltration and 4 percent involved Path Traversal. The remaining 31 percent included classic SQL injection attempts and other reconnaissance techniques. Experts warn that similar AI-masquerading tactics are likely to become more sophisticated and harder to detect with signature-based tools.
AntiMalwareSep 16, 2026Translated from Russian
