Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Actor used 1,438 FOFA accounts to steal API keys and student data

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

VECERT says a threat actor used 1,438 FOFA accounts to steal OpenAI and DeepSeek keys and data on 5,132 students.

VECERT says a threat actor registered at least 1,438 FOFA accounts via a catch-all mail system on melocc.cc and searched exposed servers for OpenAI and DeepSeek API keys. Tooling tested keys, tracked remaining credit, and fed working keys into scripts, including a GoTTY web terminal. The same server held data on 5,132 students at the Fengxian Campus of Shanghai Publishing and Printing College, refreshed every 48 hours according to VECERT, plus bots that fake reading activity to earn school points. GBHackers reports a QR module that could mint payment codes and a Guangzhou Tencent Cloud control server. VECERT labels the case VECERT-TI-2026-1107-B, Operation Ghost-Campus.

Key facts
  • Each fake FOFA account is a basic user limited to 300 web queries.
  • Three usable DeepSeek keys showed balances of 50.68, 8.52, and 0.80.
  • Student records include names, mobiles, 18-digit national IDs, and home addresses.
  • OpenAI keys matching sk-proj- were checked against api.openai.com.
  • Those DeepSeek keys were tied to labibiyat.com and nyisu.com servers.
  • GBHackers says investigators recovered FOFA passwords and JWT tokens.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersQR module for payment codes and a Guangzhou Tencent Cloud control server.
  • Cyber Security NewsCatch-all on melocc.cc, 300-query cap, case ID, and 48-hour refresh.
Vendors
OpenAIDeepSeek
Products
FOFA
Victims
Shanghai Publishing and Printing College
Organizations
VECERTTencent Cloud
Countries
China

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    Agent steals OpenAI and DeepSeek keys and 5,132 student records

    VECERT says the operator used 1,438 FOFA accounts to find exposed secrets and run a campus-card fraud bot.

  2. · 1d ago Cyber Security News

    Fake FOFA accounts used to harvest exposed OpenAI and DeepSeek keys

    VECERT says 1,438 accounts on melocc.cc searched for leaked keys and also scraped data on 5,132 students.