# AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI Coding Agents

> CloudSEK discovered an exposed open directory belonging to a Chinese-speaking threat operator who deploys autonomous AI coding agents (Claude Code, Codex, Hermes, pi agents) with safety approvals disabled to industrialize cyberattacks at scale. The operation comprises mass WordPress compromise via the wp2shell exploit chain (12,048 backdoor records across 8,996 sites), cryptocurrency wallet credential theft targeting hundreds of Solana addresses, cryptojacking via a deployed Monero miner, and data exfiltration from DePIN and blockchain platforms. The operator was developing DeadDropC2, an EtherHiding-style blockchain-based command-and-control system.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2070
- **ID:** TL-2026-2070
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-63030, CVE-2026-60137

## Description

On August 19, 2026, CloudSEK's Global Threat Intelligence team published findings on a Chinese-speaking threat operator who has weaponized autonomous AI coding agents for large-scale cybercrime. The investigation began when CloudSEK discovered an unauthenticated Python http.server (SimpleHTTP/0.6 Python/3.11.15) listening on port 18080 of IP 80.96.109.64, with directory listing enabled, exposing the operator's entire home folder. CloudSEK researchers catalogued 21,442 directories and 142,262 files, mirroring everything for offline analysis. A sister host at 103.236.54.207 had an identical open-directory setup.

The operator's AI agent fleet consists of Claude Code (Anthropic) run with dangerously-skip-permissions flag enabled and attribution/discovery headers disabled, Codex (OpenAI) routed through a proxy (code.newcli.com) with disable_response_storage set, Hermes Agent (NousResearch open-source framework providing terminal access and Telegram C2 integration), and pi agents (open-source AI agents) — all operating in full-auto mode with safety approval prompts disabled globally across all agent profiles. The agents are tasked and monitored from a single Telegram account registered circa 2017, using a reusable Chinese-language jailbreak prompt that frames every job as an authorized penetration test. A self-hosted Zhipu GLM-5.2 proxy (via LiteLLM/llmio on port 7070) routes LLM traffic to reduce costs and evade provider abuse monitoring.

The operation spans two parallel campaigns. First, an internet-wide opportunistic campaign using an automated WordPress-to-webshell exploitation pipeline employing the wp2shell exploit chain targeting WordPress core (batch/v1 endpoint route-confusion and author__not_in SQL injection), creating unique w2s_<hex> backdoor administrator accounts on 8,996 WordPress sites (12,048 confirmed backdoor records). The operator also harvested 66 genuine database admin credentials directly from victim databases and built a 3.4-million-host reconnaissance corpus using the FOFA search engine. Additional exploitation attempts included a fastjson2 deserialization RCE sweep across 6,326 targets yielding no confirmed compromises, and a separate sweep of 3 hosts rated confirmed-high-risk for deserialization processing. A Monero miner was compiled on approximately July 13 and deployed onto worker hosts for cryptojacking.

Second, a targeted cryptocurrency and DeFi theft campaign involving approximately 34 confirmed breaches. The operator scraped approximately 326 Solana wallet addresses (142 with both private key and mnemonic) and 368 unique recovery seed/phrase captures (307 passphrase-field captures plus 236 keyphrase-field captures, ~454 unique addresses total) from a phishing clone network's misconfigured Firebase Firestore database that had zero security rules. The operator extracted Firebase config from clone site frontend JavaScript bundles and read every record via the public Firestore REST API with zero authentication. Separately, the operator executed at least two confirmed on-chain drain transactions against compromised trading bot wallets and stole real encrypted wallet private keys and balances from a trading bot backend via an authentication bypass. Data exfiltration from DePIN and blockchain platforms included 158,281 vehicle records from an unauthenticated GraphQL indexer, 2,250 user wallet addresses with derivation paths from a blockchain compute platform, an exposed 746 GB blockchain node data store containing a live root key in its genesis configuration, a full CMS dataset including unpublished entries and staff emails from a privacy-messaging network with on-chain token, and live withdrawal ledgers with victim names, bank details, and payout amounts from a real-money gaming/payments platform.

The operator developed a blockchain-based command-and-control system called DeadDropC2, an EtherHiding-style architecture implemented as a Solidity smart contract on the BNB Smart Chain testnet. Commands ride in transaction calldata emitted as events (not stored in contract storage), with implants polling via read-only view calls requiring no gas and leaving no on-chain trace. Commands are encrypted with AES-256-GCM with a key derived via PBKDF2-HMAC-SHA256 at 100,000 iterations from a shared secret and static salt, with the key never touching the blockchain. The command set includes shell execution, file download/update, exfiltration, sleep timing adjustment, beacon, and kill signals — though shell, download, update, and exfil are marked as simulation stubs with only sleep, beacon, and die being live. The system was never operationally deployed, only tested locally against a web3.py in-memory test EVM, with both recovered operator wallet addresses showing zero mainnet transactions.

Attribution is based on all operator notes in native Chinese (to-do lists, methodology documents, shell-history comments, agent tasking prompts), a weather query for a specific Chinese city in test chatter, a single long-lived Telegram account registered circa 2017, and the self-hosted Zhipu GLM-5.2 proxy — a Chinese LLM backend used to cut costs and avoid Western provider abuse monitoring. The 21,442-directory, 142,262-file open directory was exposed for an observation window of July 10 through July 28, 2026. By July 30, Shodan showed the sister host (103.236.54.207) as a Windows Server exposing SMB, RPC, NetBIOS, and WinRM with ports 18080 and 7070 closed.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1587.001 Develop Capabilities: Malware
- T1588.002 Obtain Capabilities: Tool
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1505.003 Server Software Component: Web Shell
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1564 Hide Artifacts
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1213 Data from Information Repositories
- T1003 OS Credential Dumping
- T1021.004 Remote Services: SSH
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1567.002 Exfiltration to Cloud Storage
- T1496 Resource Hijacking

## Sources

- [AI-Agent-Driven Offensive Operation: Exposed Adversary Open Directory Reveals Autonomous Crypto-Theft Campaign](https://www.cloudsek.com/blog/ai-agent-driven-offensive-operation-crypto-wallet-credential-compromise)
- [wp2shell Defenders Guide: Incident Response and Indicators of Compromise](https://labs.eye.security/wp2shell-defenders-guide/)
- [wp2shell Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core](https://businessinsights.bitdefender.com/technical-advisory-wp2shell-unauthenticated-remote-code-execution-full-site-takeover-wordpress-core)
- [wp2shell Critical Unauthenticated RCE Chain in WordPress Core — Centripetal Threat Research](https://www.centripetal.ai/threat-research/wp2shell-critical-unauthenticated-rce-chain-in-wordpress-core)
- [wp2shell in the Wild: Under 48 Hours from Patch to Mass Exploitation — ELLIO Technologies](https://ellio.tech/en/blog/wp2shell-in-the-wild-under-48-hours-from-patch-to-mass-exploitation/)
- [CloudSEK FortiBleed: Inside the FortiBleed Open Directory — Technical Analysis of Attacker Infrastructure](https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind)
- [CloudSEK Operation Escaneo: Infrastructure Exposure, TTP Analysis of Latin American Cyberattack Campaign](https://www.cloudsek.com/blog/operation-escaneo-mexican-government-financial-institutions-cyberattack)
- [Unveiling ErrTraffic: Inside a Growing ClickFix Malware Distribution Framework (EtherHiding C2) — Sekoia](https://blog.sekoia.io/unveiling-errtraffic-inside-a-growing-clickfix-malware-distribution-framework/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2070