Attackers Impersonate AI Agents to Drive Credential Stuffing Attacks
Adversaries are leveraging the popularity of AI agents by impersonating them to conduct sophisticated credential stuffing attacks, overwhelming security systems that fail to distinguish between legitimate and malicious automated traffic.
In a concerning development for online security, threat actors are increasingly impersonating legitimate AI agents to conduct large-scale credential stuffing operations. A recent incident highlighted this trend when an online marketplace experienced over 414,000 visits from traffic masquerading as a popular consumer AI agent. Every single one of these visits targeted the sign-in page, and all resulted in authentication errors, indicating a concerted effort to test stolen username and password combinations.
The volume of this malicious traffic significantly outpaced that of genuine AI agents. Cequence Security reported that the fake agent's activity accounted for approximately one and a half times the total legitimate AI agent visits observed across five different industries during the same week. This surge underscores the effectiveness of adversaries in exploiting the trust and perceived legitimacy associated with AI technologies.
This tactic is not isolated. In another case, shortly after a major consumer platform launched its personal AI agent, a new stream of automated traffic emerged on the network of a Tier 1 telecom carrier. This traffic rapidly scaled from a few hundred requests daily to a sustained 19,000 to 32,000 requests per day within three weeks. It successfully navigated sign-ins, completed multi-factor authentication, reviewed billing information, checked device trade-in eligibility, and even added devices to shopping carts, all while presenting itself as a standard desktop browser.
The giveaway for this sophisticated operation was a browser update. While legitimate users took approximately two weeks to adopt a new browser version, the malicious traffic shifted from nearly non-existent to around 98% adoption within 48 hours. This rapid fleet-wide update pattern is characteristic of automated cloud browser management, suggesting a highly organized and resourced threat actor.
While most AI agent traffic is benign, focusing on tasks like reading pages or comparing products, a significant portion does interact with sensitive account functions. Cequence's analysis of over 280,000 agent visits revealed that about 15% engaged in actions such as booking, buying, signing in, or managing accounts. It is within these higher-risk interactions that impostor agents can cause substantial damage, including financial theft or account takeover.
Security experts emphasize the importance of focusing on behavioral analysis rather than solely relying on identity or source reputation. The advice is to scrutinize the actions within a session. If traffic consistently targets only the sign-in page and fails repeatedly, it should be flagged as abuse, regardless of the 'agent' name it presents. Critical security measures like step-up verification and rate limiting should be reserved for high-stakes actions such as payments, payee changes, or account control modifications.
Traditional bot detection scores often fail to identify these advanced impersonation tactics. At one global consumer brand, behavioral analysis was the sole mechanism that blocked 3.51 million unauthorized login attempts in a single month. A staggering 82% of this malicious traffic scored too low to trigger conventional bot defenses, highlighting the critical need for more nuanced security strategies that prioritize observed behavior over simple identification metrics.
This evolving threat landscape, where malicious actors weaponize the very AI tools designed to enhance user experience and security, necessitates a proactive and adaptive defense posture. Organizations must invest in advanced behavioral analytics and continuously refine their security protocols to effectively distinguish between legitimate AI-driven operations and sophisticated impersonation attempts.