Agent steals OpenAI and DeepSeek keys and 5,132 student records
Original title: AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers While Harvesting Data of 5,132 Chinese Students
VECERT says the operator used 1,438 FOFA accounts to find exposed secrets and run a campus-card fraud bot.
GBHackers reports VECERT findings on an AI resource-acquisition agent that searches FOFA for exposed servers, extracts OpenAI and DeepSeek API keys, and checks balances. Stolen tokens feed a GoTTY terminal and a bot that fakes student activity and claims bonus points. A separate module holds records on 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, including national ID numbers and campus-card data.
Unconfirmed: The article lists the mail-server address inconsistently and attributes the operation to VECERT's investigation.
- Investigators recovered 1,438 FOFA accounts with passwords and JWT tokens.
- Three working DeepSeek keys showed balances of 50.68, 8.52 and 0.80.
- Records include names, mobiles, 18-digit national IDs and home addresses.
- A QR module covering more than a thousand sessions could mint payment codes.
- The control server was a Tencent Cloud VPS in Guangzhou, VECERT said.
Impact: Stolen API keys and student identity and payment data
- 1.Keep API keys out of web-accessible .env files, Git repositories and container configs.
- 2.Rotate any key that appeared in a public location and set spending limits.
- 3.Watch for sudden API usage from unfamiliar addresses.
- Products
- FOFA
- Organizations
- VECERTTencent Cloud
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | labibiyat.com | ng 50.68, 8.52 and 0.80 units, taken from servers including labibiyat.com and nyisu.com. The stolen tokens power a GoTTY terminal bra |
| domain | melocc.cc | tead, the actor built a catch-all mail system on the domain melocc.cc. The subdomains mail, api, pop, imap, and smtp all resolve |
| domain | nyisu.com | 0.80 units, taken from servers including labibiyat.com and nyisu.com. The stolen tokens power a GoTTY terminal branded “Pi AI Co |
| ipv4 | 134.175.71.194 | RT researchers said that , the attacker’s control server at 134.175.71(.)194, a Tencent Cloud VPS in Guangzhou, show an operation that |
| ipv4 | 156.233.234.242 | The article lists the mail server address inconsistently as 156.233.234(.)242 in one place, so verify this indicator before you publish |
| ipv4 | 156.251.234.242 | he subdomains mail, api, pop, imap, and smtp all resolve to 156.251.234.242. A US server hosted by Cognetcloud INC (ASN 401701) provide |
From the original article
3 min read at gbhackers.com
AI-driven resource-acquisition agent. It hunts for exposed servers, steals OpenAI and DeepSeek API keys, and uses the free compute to power academic fraud and student data theft. The agent targets fofa.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.