AI agent abuses exposed .env and Docker secrets to steal OpenAI and DeepSeek API keys and student PII in China
VECERT researchers describe an automated operation run by an AI-driven resource-acquisition agent that searches FOFA for exposed .env files, Docker configurations and poorly secured Git repositories, then pulls OpenAI and DeepSeek API keys from the hosts it finds and uses them as free compute. The actor obtained at least 1,438 FOFA accounts by building a catch-all mail system on the melocc.cc domain, so a script could register, read the confirmation email and activate the account within seconds. The stolen keys were tested against provider APIs and sorted by status, and three working DeepSeek keys were found with balances. A second module held a PII database of 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, and a QR-code module tied to more than a thousand active sessions could produce valid payment codes for high-balance campus cards. No CVE is involved: the entry point is exposed secrets and misconfiguration, which keeps the risk below critical, but the active data theft and the campus payment abuse make it urgent for defenders.
Detalhes técnicos
The agent queries FOFA with a 300-query cap per account and rotates the tokens of all 1,438 accounts, which the article says allows tens of thousands of free queries a day. The attacker's control server at 134.175.71.194 is a Tencent Cloud VPS in Guangzhou, and the mail subdomains (mail, api, pop, imap, smtp) resolve to 156.251.234.242 on a US server hosted by Cognetcloud INC (ASN 401701). Regular expressions extract AI platform keys; OpenAI project keys (sk-proj-) are checked against api.openai.com, where an HTTP 429 without credits is tagged valid_no_balance and a 401 marks a revoked key. DeepSeek keys matching sk-[a-f0-9]{32} are checked against the balance endpoint GET /user/balance. The stolen tokens drive a GoTTY terminal branded "Pi AI Coding Assistant" running a fake-activity bot that sends a heartbeat every 30 seconds and claims bonus points through an internal API, reaching balances such as 252 points. The PII module refreshes every 48 hours and holds full names, student IDs, mobile numbers, 18-digit national ID numbers, home addresses, campus-card balances up to 1,474.84 yuan and microtransaction histories.
Remediação
Remove API keys from web-accessible .env files, Git repositories and container configurations, and rotate any key that has appeared in a public location. Set spending limits on AI provider accounts and monitor for sudden usage from unfamiliar addresses. Universities should segment campus-card systems, protect student identity data and limit the lifetime of session tokens.
Linha do tempo
-
AI agent abuses exposed .env and Docker secrets to steal OpenAI and DeepSeek API keys and student PII in China
ler a análise desta fonte ocultar
VECERT researchers describe an automated operation run by an AI-driven resource-acquisition agent that searches FOFA for exposed .env files, Docker configurations and poorly secured Git repositories, then pulls OpenAI and DeepSeek API keys from the hosts it finds and uses them as free compute. The actor obtained at least 1,438 FOFA accounts by building a catch-all mail system on the melocc.cc domain, so a script could register, read the confirmation email and activate the account within seconds. The stolen keys were tested against provider APIs and sorted by status, and three working DeepSeek keys were found with balances. A second module held a PII database of 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, and a QR-code module tied to more than a thousand active sessions could produce valid payment codes for high-balance campus cards. No CVE is involved: the entry point is exposed secrets and misconfiguration, which keeps the risk below critical, but the active data theft and the campus payment abuse make it urgent for defenders.
Technical Details
The agent queries FOFA with a 300-query cap per account and rotates the tokens of all 1,438 accounts, which the article says allows tens of thousands of free queries a day. The attacker's control server at 134.175.71.194 is a Tencent Cloud VPS in Guangzhou, and the mail subdomains (mail, api, pop, imap, smtp) resolve to 156.251.234.242 on a US server hosted by Cognetcloud INC (ASN 401701). Regular expressions extract AI platform keys; OpenAI project keys (sk-proj-) are checked against api.openai.com, where an HTTP 429 without credits is tagged valid_no_balance and a 401 marks a revoked key. DeepSeek keys matching sk-[a-f0-9]{32} are checked against the balance endpoint GET /user/balance. The stolen tokens drive a GoTTY terminal branded "Pi AI Coding Assistant" running a fake-activity bot that sends a heartbeat every 30 seconds and claims bonus points through an internal API, reaching balances such as 252 points. The PII module refreshes every 48 hours and holds full names, student IDs, mobile numbers, 18-digit national ID numbers, home addresses, campus-card balances up to 1,474.84 yuan and microtransaction histories.
Remediation
Remove API keys from web-accessible .env files, Git repositories and container configurations, and rotate any key that has appeared in a public location. Set spending limits on AI provider accounts and monitor for sudden usage from unfamiliar addresses. Universities should segment campus-card systems, protect student identity data and limit the lifetime of session tokens.