Cybersecurity experts at the Solar group have identified a new method used by attackers to target Russian web applications. Hackers are masking malicious traffic by spoofing HTTP headers to impersonate requests from popular AI services, including ChatGPT, DeepSeek, Grok, Claude, and Perplexity.
The Solar WAF team uncovered this activity while analyzing web application data between January 2024 and August 2026. Attackers typically target search bars and input fields on websites to inject malicious code and gain unauthorized access to sensitive data.
The first instance of a request disguised as DeepSeekBot was recorded on August 12, 2026. By August 27, analysts observed additional variants mimicking Claude-User, ChatGPT-User, GrokBot, and Perplexity-User. These attackers modify the User-Agent field in HTTP requests.
More than half of the detected attacks utilized DNS Rebinding. This technique allows a malicious website to bypass browser security policies and gain access to devices within a local network.
