AI-driven resource-acquisition agent. It hunts for exposed servers, steals OpenAI and DeepSeek API keys, and uses the free compute to power academic fraud and student data theft.
The agent targets fofa.info, a search engine for internet-connected assets. To get around registration limits, the actor avoided public disposable email services.
Instead, the actor built a catch-all mail system on the domain melocc.cc. The subdomains mail, api, pop, imap, and smtp all resolve to 156.251.234.242.
A US server hosted by Cognetcloud INC (ASN 401701) provides the backend. The article lists the mail server address inconsistently as 156.233.234(.)242 in one place, so verify this indicator before you publish it.
The setup lets a script register an account, read the confirmation email over its own POP or IMAP service, extract the activation link and finish activation within seconds.
Investigators recovered a file named fofa_accounts.csv and control-panel screenshots confirming at least 1,438 accounts. The file also holds passwords and JWT tokens ready for API use.
Each account is a low-tier “Registered User” with no F-points and a cap of 300 web queries. The attacker rotates all 1,438 tokens to spread the load, which allows tens of thousands of free queries a day.
The queries hunt for exposed .env files, Docker configurations and poorly secured Git repositories.
VECERT researchers said that, the attacker’s control server at 134.175.71(.)194, a Tencent Cloud VPS in Guangzhou, show an operation that goes well beyond simple data scraping.
AI-Powered Data Theft
When the scanner finds a vulnerable host, the agent uses regular expressions to pull out AI platform keys and sort them. For OpenAI project keys (sk-proj-), it queries api.openai.com and labels each result.
A key that returns HTTP 429 with no credits is tagged valid_no_balance. A 401 response marks a revoked key. OpenAI’s documentation separates these cases.
A 429 can mean rate limiting or an exhausted prepaid balance, and a 401 means the key is invalid or revoked.developers.
DeepSeek keys match the pattern sk-[a-f0-9]{32}. The agent also checks their monetary balance.
DeepSeek documents a balance endpoint, GET /user/balance, that returns an availability flag and balance details.
The dashboard listed three working keys holding 50.68, 8.52 and 0.80 units, taken from servers including labibiyat.com and nyisu.com.
The stolen tokens power a GoTTY terminal branded “Pi AI Coding Assistant”. That terminal supports scripts that run a fake-activity bot.
Every 30 seconds the bot sends an HTTP 200 heartbeat that imitates a student’s active reading session.
It then claims bonus points through an internal API, such as +10 points per cycle, and checks that the account has not been frozen. The bot reached balances such as 252 points.
The second module is a PII database covering 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College. Most were born between 2006 and 2008. The records include these fields:
Full names and student IDs, mobile numbers, 18-digit national ID numbers, family home addresses, campus-card balances reaching 1,474.84 yuan, and detailed microtransaction histories. The scraper refreshes every 48 hours.
A QR-code module controlling more than a thousand active sessions could generate valid payment codes for high-balance cards, enabling in-person fraud.
The campaign shows how exposed secrets turn into attacker compute. Defenders should keep API keys out of web-accessible .env files, Git repositories and container configurations.
They should rotate any key that has appeared in a public location and set spending limits. They should also watch for sudden usage from unfamiliar addresses.
Universities should segment campus-card systems, protect student identity data and limit session tokens.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
