BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacks
French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.
Socradar researchers analyzed the exposed infrastructure of a French-speaking crew called BlackHatSect0r && DXQRTXX, which ran a Nous Research Hermes agent on a DeepSeek model with safety controls removed via HERMES_DISABLE_SAFETY=1. A custom Go-based C2 platform, DXSCAN, was exposed on port 8080 with over 200 secret-detection patterns, a vault of 16,834 harvested credentials, and scanning activity queuing 2.75 million domains and reaching more than 726,000 hosts. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, plus JWT-forging tooling for a cryptocurrency exchange. Most confirmed compromises relied on exposed secrets and cloud misconfiguration rather than novel exploits; the one cited vulnerability, CVE-2026-42530, is an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2.
- Operator stripped Hermes agent refusal logic and set HERMES_DISABLE_SAFETY=1 to enable unconditional attack automation.
- Exposed DXSCAN Go C2 leaked 16,834 harvested credentials and 200+ patterns for .env, YAML, JSON, PHP, WordPress secrets.
- Scanning queued 2.75 million domains, reached 726,000 hosts, and generated 1.37 million IP addresses.
- Vishing kit held ~450,000 French telecom records, with 1,697 subscribers aged 50+ targeted via Société Générale-themed calls.
- Defenders urged to hunt HERMES_DISABLE_SAFETY=1, SOUL.md, .hermes/ artifacts and rotate any exposed credentials.
- CVEs
- CVE-2026-42530
- ATT&CK
- T1595.002 Vulnerability ScanningT1552.001 Unsecured Credentials: Credentials In FilesT1530 Data from Cloud Storage ObjectT1566.004 Spearphishing VoiceT1071.001 Application Layer Protocol: Web Protocols
- Threat actors
- BlackHatSect0rDXQRTXX
- Organizations
- Socradar
- Countries
- FranceUnited States
- AI models
- DeepSeek
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42530 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module | 9.2 | 6% | PoC |
From the original article
4 min read at gbhackers.com
A French-speaking cybercrime crew calling itself BlackHatSect0r && DXQRTXX allegedly disabled safety controls in a self-hosted AI agent and used the resulting system to automate mass credential harvesting, target discovery, phishing preparation, and attack orchestration. The internet-exposed server reportedly contained 4.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.