Unknown actors are conducting widespread vulnerability scans while impersonating AI assistants like ClaudeBot, according to reports circulating in security communities.
Security researchers have detected mass vulnerability scanning activity originating from sources spoofing popular AI bots, including Anthropic's ClaudeBot. The scans appear designed to identify exploitable weaknesses across target systems.
The spoofing technique masks the true origin of the reconnaissance activity, complicating attribution and response efforts. By mimicking legitimate AI bot traffic, attackers aim to evade detection systems and blend malicious requests with normal API usage patterns.
The scope of the campaign remains unclear, but security forums suggest multiple organizations have observed similar patterns. The discovery raises questions about bot verification mechanisms and the risks of credential misuse in AI service ecosystems.
Experts recommend implementing stricter bot identification protocols and monitoring for suspicious scanning patterns. Organizations should verify bot traffic through official channels rather than relying solely on User-Agent headers or identifying claims.
A data theft campaign exploits misconfigured Salesforce Experience Cloud and ServiceNow customer portals to harvest sensitive information. The attackers use custom tools to access data exposed to anonymous users.
A compromised AI package exposed credentials from 2,500 users in a large-scale supply-chain attack. Attackers scraped and exfiltrated terabytes of sensitive data.
A new Android malware combo pairs NFC relay malware called WindRelay with the SpyNote remote administration tool to steal credit card data and conduct fraud in real time.
A critical vulnerability in Adobe Commerce and Magento platforms is being actively exploited to compromise customer accounts. The flaw, tracked as CVE-2026-71362, poses immediate risk to e-commerce operations worldwide.