An automated, AI-driven agent used 1,438 fake accounts on the FOFA search engine to hunt exposed servers for OpenAI and DeepSeek API keys, according to researchers at VECERT. The stolen keys were then used to power academic fraud tools, and investigators also found a database holding personal data on 5,132 students.

VECERT tracked the operation as case VECERT-TI-2026-1107-B and linked it to a wider campaign it calls Operation Ghost-Campus. The findings were published on 10 November and reported by GBHackers and Cyber Security News.

1,438 fake accounts to scan the internet

FOFA is a search engine for internet-connected devices and servers. To get around its registration limits, the attacker built a private catch-all email system on the domain melocc.cc, so a script could register an account, read the confirmation email through its own mail servers and finish activation within seconds.

Investigators recovered a file named fofa_accounts.csv and control-panel screenshots confirming at least 1,438 accounts. Each account is a low-tier registered user with a cap of 300 web queries, but rotating all 1,438 tokens spreads the load and allows tens of thousands of free queries a day.

The searches look for exposed .env files, Docker configurations and poorly secured Git repositories, which often hold secrets left in by mistake. The attacker ran the operation from a control server at 134.175.71.194, a Tencent Cloud virtual server in Guangzhou, according to VECERT.

How the stolen keys were tested and used

When the scanner finds a vulnerable host, the agent uses regular expressions to pull out AI platform keys and sort them. For OpenAI project keys, which start with sk-proj-, it queries api.openai.com and labels each result. A key that returns HTTP 429 with no credits is tagged as valid but without balance, while a 401 response marks a revoked key.

DeepSeek keys match the pattern sk- followed by 32 hexadecimal characters, and the agent also checks their monetary balance. A dashboard recovered by investigators listed three working DeepSeek keys holding balances of 50.68, 8.52 and 0.80, taken from servers including labibiyat.com and nyisu.com.

The stolen tokens power a web terminal branded Pi AI Coding Assistant. That terminal runs a fake-activity bot which sends an HTTP 200 heartbeat every 30 seconds to imitate a student reading, then claims bonus points through an internal API, such as 10 points per cycle. The bot reached balances of 252 points.

Student data also harvested

The same operation held a second module: a personal data database covering 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, most born between 2006 and 2008. The records include full names and student ID numbers, mobile numbers, 18-digit national ID numbers, family home addresses, campus-card balances reaching 1,474.84 yuan, and detailed microtransaction histories. The scraper refreshes the data every 48 hours.

A QR-code module controlling more than a thousand active sessions could generate valid payment codes for high-balance cards, enabling in-person fraud. VECERT says the actor may be based in China and links the operation to its earlier findings at the same college.

How to protect API keys

The campaign shows how an exposed secret can turn into free computing power for an attacker. Developers should keep API keys out of web-accessible .env files, Git repositories and container configurations, rotate any key that has appeared in a public location, and set spending limits on AI accounts.

Teams should also watch for sudden usage from unfamiliar addresses. Universities should segment campus-card systems, protect student identity data and limit session tokens, so a single exposed server cannot hand an attacker both compute and personal data.