Fake FOFA accounts used to harvest exposed OpenAI and DeepSeek keys
Original title: Hackers Use 1,438 Fake FOFA Accounts to Steal OpenAI and DeepSeek API Keys Across the Internet
VECERT says 1,438 accounts on melocc.cc searched for leaked keys and also scraped data on 5,132 students.
VECERT says a threat actor automated registration of at least 1,438 fake FOFA accounts through a catch-all mail system on melocc.cc, then searched for exposed .env files, Docker settings, and Git repositories holding OpenAI and DeepSeek API keys. Recovered tooling tested keys, tracked remaining credit, and fed working keys into the attacker’s own scripts, including a GoTTY web terminal. The same server held tools aimed at Shanghai Publishing and Printing College; VECERT says data on 5,132 Fengxian-campus students was collected and refreshed every 48 hours. VECERT tracks the case as VECERT-TI-2026-1107-B and calls the wider activity Operation Ghost-Campus.
Unconfirmed: Account counts, key balances, student-data theft, and a possible China base are VECERT’s findings, not independently confirmed here.
- Each fake account is a basic user limited to 300 web queries.
- One dashboard listed three usable DeepSeek keys with balances 50.68, 8.52, and 0.80.
- Those DeepSeek keys were tied to labibiyat.com and nyisu.com servers.
- OpenAI keys matching sk-proj- were checked against api.openai.com.
- Bots reportedly fake reading activity to earn school points.
Impact: Stolen AI API credits and claimed student personal data
- 1.Keep API keys out of .env files, public repositories, and web folders.
- 2.Revoke and rotate any key that may have been exposed and review usage logs.
- 3.Set spending limits and watch for the listed melocc.cc infrastructure.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | imap.melocc.cc | in pop.melocc.cc POP server for activation emails Subdomain imap.melocc.cc IMAP server for activation emails Subdomain smtp.melocc.cc |
| domain | labibiyat.com | 50.68, 8.52 and 0.80. Those keys came from servers tied to labibiyat.com and nyisu.com. What the Attacker Does With the Stolen AI Ac |
| domain | melocc.cc | actor runs a private “catch-all” email system on the domain melocc.cc. Its subdomains, including mail, api, pop, imap and smtp, a |
| domain | nyisu.com | .80. Those keys came from servers tied to labibiyat.com and nyisu.com. What the Attacker Does With the Stolen AI Access The stole |
| domain | pop.melocc.cc | cture Subdomain api.melocc.cc Mail infrastructure Subdomain pop.melocc.cc POP server for activation emails Subdomain imap.melocc.cc I |
| ipv4 | 134.175.71.194 | , US). This differs from the DNS analysis value. IP address 134.175.71(.)194 Tencent Cloud VPS in Guangzhou, China, used as the contro |
| ipv4 | 156.233.234.242 | 6.251.234.242 Mail server IP in the DNS analysis IP address 156.233.234(.)242 Mail server IP in the infrastructure section (Cognetcloud |
| ipv4 | 156.251.234.242 | tion emails Subdomain smtp.melocc.cc SMTP server IP address 156.251.234.242 Mail server IP in the DNS analysis IP address 156.233.234(. |
From the original article
4 min read at cybersecuritynews.com
A threat actor has built an automated system that registers fake accounts on the FOFA search engine, scans the internet for leaked AI keys, and tests them for free use. The operation relies on 1,438 fake FOFA accounts to find exposed OpenAI and DeepSeek API keys on misconfigured servers. The stolen keys power the attacker’s […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.