Attackers impersonated consumer AI agent to generate 414,210 marketplace sign-in visits

Attackers impersonated a popular consumer AI agent to generate 414,210 visits to an online marketplace sign-in page during one week in October, and every visit failed as part of a credential-stuffing campaign fed by stolen username and password pairs, Cequence said.

Cequence’s count of genuine agent visits across five industries that week put the fake agent’s traffic at about one and a half times the legitimate total. The company said defenders should watch session behavior rather than trust a claimed agent name, because traffic that only visits a sign-in page and fails every time is abuse whatever name it uses. The company also recommends step-up verification plus rate limits covering payments, payee changes and account control changes.

Automated traffic on the sites of a Tier 1 telecom carrier followed a major consumer platform’s September launch of a personal agent the next day, growing within three weeks from roughly 100 daily requests to a sustained range of 19,000 to 32,000. That traffic pretended to be an ordinary desktop browser as it signed in, completed multifactor authentication, reviewed bills, checked trade-in eligibility and added devices to carts. Adoption reached about 98 percent within roughly 48 hours, while consumer adoption of the new browser version took about two weeks. Operators counted more than 270,000 carrier transactions as automated but not malicious and allowed the traffic to keep running under monitoring.

In a mid-October sample across five industries, Cequence recorded 281,627 agent visits, with 85 percent involving reading pages or comparing products and about one in seven moving into booking, buying, signing in or account management. One global consumer brand saw behavioral analysis block 3,510,000 unauthorized login attempts over 31 days. Roughly 82 percent of the brand’s traffic scored too low to trigger conventional bot detection.

The pattern extends beyond one agent. CQ Prime Research found a scanner active from late September through late October that pretended to be 32 bots, including tools from OpenAI, Anthropic, Perplexity and Meta, and searched retail, financial services, telecommunications, energy and software organizations for passwords, API keys and cloud credentials. Researchers identified the activity on Oct. 21, and malicious AI bot traffic hit 48 percent of Cequence-protected organizations on one October day. Bursts of 50 to 190 requests lasted about 8 seconds before the scanner moved to the next target around the clock, rotating through about 32 bot identities evenly and switching from OpenAI to Anthropic to Meta to Perplexity within seconds from one machine.

For every fake Claude identity, Anthropic’s crawler contact address was the one the attacker used. The scanner asked for configuration files, cloud credential files and private SSH keys from about 90 paths without identifying itself, and nearly all requests were blocked or failed. At financial services firms, legitimate customer AI agents accounted for fewer than one in 4,000 requests.

Will Glazier, director of threat research and data science for CQ Prime at Cequence Security, wrote that attackers check which agents a business trusts, then impersonate those agents. “They are no longer trying to break into these systems. Instead, they are simply logging in disguised as trusted AI agents,” said Shane Barney, chief information security officer at Keeper Security.

The n0n extortion group pairs AI tooling with conventional credential stuffing. SOCRadar’s Threat Research Unit found an exposed n0n staging server in late September 2026 with 1,719 files including 829 attack scripts, and the group’s automated credential stuffing hit 305 FortiGate SSL-VPN appliances while it looked for exposed Remote Desktop Protocol services.

By mid-to-late October, n0n’s spending on large language model API usage passed $7,216 through an AI coding agent called opencode that draws on 154 models. As of mid-October, the group’s Tor leak site (a dark-web site reachable via Tor where victims are listed) named 93 victims and ransom demands totaling $283,700,000, while confirmed targets reached 23 organizations across 14 countries with no confirmed ransom payments.

On Nov. 6, 2026, Pakistan’s National Cyber Emergency Response Team issued a warning to banks and critical infrastructure operators concerning AI-enabled threats and automated login attempts. It recommended multifactor authentication and protection against automated login attempts. Separately, it called for privileged-access management and for independent reconciliation of transactions.

The advisory said financial services and operational technology systems needed particular attention because a successful breach could bring serious financial, commercial and physical consequences. It said banks could face attacks on core banking systems and digital banking platforms. It also flagged application programming interfaces and payment systems as bank attack surfaces, along with customer-facing applications.

National CERT flagged insecure remote access, industrial control systems and connected Internet of Things devices as critical infrastructure vulnerabilities, alongside risks from third-party service providers. Potential targets included oil and gas facilities and water utilities. Power generation and distribution networks were also named, as were manufacturing plants and transportation systems.

Disrupting physical processes and essential public services could result from a successful compromise of operational technology, National CERT said. It urged organizations to assess preparedness against bot-driven AI cyber attacks. It also told them to keep security logs and report suspected incidents through national cybersecurity channels.

Google Threat Intelligence Group saw financially motivated attackers use AI agents to launch mass credential-harvesting campaigns within six hours. An exposed command-and-control server hosted a framework called Recon. Recon managed more than 23,800 harvested secrets, including API keys.

Cybernews discovered a publicly accessible Elasticsearch cluster on June 12. It held 24 billion stolen credential records drawn from 36 sources. Have I Been Pwned added 56.3 million e-mail addresses and 124 million unique passwords from infostealer malware logs on June 15.

Infostealer logs typically contain usernames, e-mail addresses, plaintext passwords and login URLs, and they sometimes hold active browser session cookies, with device fingerprints also possible. Harvesting active session cookies lets attackers bypass multifactor authentication entirely by impersonating an already authenticated session. Pieter Arntz, a Malwarebytes security researcher, said the exposed data “appears more heavily weighted toward fresh infostealer logs, rather than older, static breach data.”

National CERT listed repeated authentication failures and unusual automated login attempts as possible indicators of cyber intrusions. It also named credential stuffing, abnormal API requests, unauthorized application configuration changes and irregular transaction patterns.