Operation Ghost Campus: AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers and Harvest Data of 5,132 Chinese Students

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5626 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Operation Ghost Campus (TL-2026-5626) - Exposed .env / Docker Config Retrieved Over HTTP

Detects successful (HTTP 200) retrieval of .env files, docker-compose files, Dockerfiles or .docker/config.json from web servers you operate. Operation Ghost Campus (TL-2026-5626) finds exactly these exposed files via fofa.info queries and regex-extracts OpenAI (sk-proj-) and DeepSeek (sk-[a-f0-9]{32}) API keys from them (CWE-538, CWE-522; ATT&CK T1552.001). A 200 on these paths means the secrets file is publicly readable and every key inside must be treated as compromised and rotated.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1552.001, T1596
• Data sources: web_server_access_logs, index=web sourcetype=access_combined, W3CIISLog
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined status=200
| eval path=lower(coalesce(uri_path, uri))
| where match(path, "(^|/)([.]env([.][a-z0-9_-]+)?|docker-compose[.]ya?ml|dockerfile|[.]docker/config[.]json)$")
| stats count AS hits dc(path) AS distinct_paths values(path) AS paths values(useragent) AS user_agents min(_time) AS first_seen max(_time) AS last_seen BY clientip, host
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - hits

Microsoft KQL

W3CIISLog
| where TimeGenerated > ago(24h)
| where scStatus == '200'
| extend path = tolower(csUriStem)
| where path matches regex '(^|/)([.]env([.][a-z0-9_-]+)?|docker-compose[.]ya?ml|dockerfile|[.]docker/config[.]json)$'
| summarize Hits = count(), DistinctPaths = dcount(path), Paths = make_set(path, 20), UserAgents = make_set(csUserAgent, 5), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, sSiteName, Computer
| project FirstSeen, LastSeen, cIP, sSiteName, Computer, Hits, DistinctPaths, Paths, UserAgents
| order by Hits desc

Sigma

title: Operation Ghost Campus - Exposed .env or Docker Configuration File Retrieved
id: 3f6a1c52-8d47-4b19-a0e3-5c2b7d9e4a11
status: experimental
description: Detects HTTP 200 responses for .env, docker-compose and Docker config files. TL-2026-5626 (Operation Ghost Campus) harvests OpenAI and DeepSeek API keys from such exposed files.
references:
    - https://gbhackers.com/ai-powered-data-theft/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.credential-access
    - attack.t1552.001
    - attack.reconnaissance
    - attack.t1596
logsource:
    category: webserver
detection:
    selection:
        c-uri|endswith:
            - '/.env'
            - '/.env.local'
            - '/.env.production'
            - '/.env.dev'
            - '/.env.bak'
            - '/docker-compose.yml'
            - '/docker-compose.yaml'
            - '/Dockerfile'
            - '/.docker/config.json'
        sc-status: 200
    condition: selection
falsepositives:
    - Authorized external attack-surface scanners or pentests
    - Intentionally published example configuration files
level: high

Known false positives:

• Authorized external vulnerability scanners and pentest engagements requesting these paths
• Intentionally published sample .env.example style files that contain no secrets

Tuning notes: Point index/sourcetype at your real web log source (nginx/Apache access_combined or IIS ms:iis:auto). Exclude approved scanner source IPs via a lookup. Any 200 on these paths from an unapproved client is a finding: remove the file from the web root, block dotfiles at the server, and rotate every key it contained.

• 🔒 Operation Ghost Campus - Exposed .git Repository Metadata Retrieved · unlock with TL Creds
• 🔒 Operation Ghost Campus - API Key Validation Command (DeepSeek /user/balance, OpenAI sk-proj-) · unlock with TL Creds
• 🔒 Operation Ghost Campus - Mail Protocol Traffic to [indicator] Catch-All Mail Server · unlock with TL Creds
• 🔒 Operation Ghost Campus - Scripted Client Harvesting Secret Files From Web Server · unlock with TL Creds
• 🔒 Operation Ghost Campus - GoTTY Web Terminal Started With Write Access · unlock with TL Creds
• 🔒 Operation Ghost Campus - DNS Query for [indicator] Infrastructure · unlock with TL Creds
• 🔒 Operation Ghost Campus - Non-Browser Process Calling OpenAI/DeepSeek API (Key Validation) · unlock with TL Creds
• 🔒 Operation Ghost Campus - Connection to Attacker Control Server [indicator] · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5626.

Sample indicators (3 of 15)

• IP address: 156.251.234[.]242
• Domain: melocc[.]cc
• IP address: 134.175.71[.]194

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

Technical analysis

The research was originally published by VECERT and reported by GBHackers on 2026-11-10; no actor is named.

Operation Ghost Campus is the name VECERT gave to an investigation, reported by GBHackers on 2026-11-10, into an AI-driven resource-acquisition agent. The agent combines large-scale free-tier abuse of the fofa.info internet-asset search engine, harvesting of AI-platform API keys from misconfigured servers, and scraping of a Chinese university campus-card system. The source does not state when the activity began and does not name an actor.

Account farming: the operator avoided public disposable-mail services and ran its own catch-all mail system on melocc.cc. The subdomains mail, api, pop, imap and smtp all resolve to 156.251.234.242, a US server from Cognetcloud INC (ASN 401701). A script registers a fofa.info account, reads the confirmation email over the operator's own POP/IMAP service, extracts the activation link and activates the account within seconds. Control-panel screenshots show 1,438 confirmed accounts stored in fofa_accounts.csv, which holds account credentials and JWT tokens. Each account is a low-tier 'Registered User' with no F-points and a 300-query web cap. Rotating all tokens yields tens of thousands of free queries per day.

Secret hunting and key validation: the fofa queries target exposed .env files, Docker configurations and poorly secured Git repositories. Regular expressions pull AI-platform keys from the exposed hosts and sort them. OpenAI project keys (sk-proj-) are tested against api.openai.com. HTTP 429 with no credits is tagged valid_no_balance and HTTP 401 is tagged revoked. The article notes that a 429 can also mean rate limiting, so this tagging can misclassify keys. DeepSeek keys match sk-[a-f0-9]{32} and are checked through GET /user/balance. The dashboard listed three working DeepSeek keys with balances of 50.68, 8.52 and 0.80 units, taken from servers including labibiyat.com and nyisu.com. The attacker control server is 134.175.71.194, a Tencent Cloud VPS in Guangzhou.

Monetization and fraud: stolen tokens power a GoTTY terminal branded 'Pi AI Coding Assistant'. It supports scripts for a fake-engagement bot that sends an HTTP 200 heartbeat every 30 seconds to imitate an active reading session. The bot claims bonus points through an internal API (about +10 per cycle) and checks whether the account has been frozen. Balances up to 252 points are cited. A second module holds a PII database of 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, mostly born 2006 to 2008. It covers names, student IDs, phone numbers, national ID numbers, home addresses, campus-card balances and microtransaction histories, and the scraper refreshes every 48 hours. A QR-code module controls more than 1,000 active sessions and, according to the article, could generate valid payment codes for high-balance campus cards, enabling in-person fraud.

Caveats: the GBHackers article gives the mail server IP as 156.233.234.242 in one place, which conflicts with 156.251.234.242 and is treated as unverified and excluded from the IOCs. The VECERT Medium report returned HTTP 403 and BeaconBeagle returned HTTP 502 during research, so the article is the only primary source. No CVE, CVSS score or file hashes are given.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Collection

T1119 Automated Collection

Command and Control

T1219 Remote Access Tools

Impact

T1496.004 Resource Hijacking: Cloud Service Hijacking; T1657 Financial Theft

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.003 Acquire Infrastructure: Virtual Private Server; T1585 Establish Accounts

Reconnaissance

T1589.001 Gather Victim Identity Information: Credentials; T1593.003 Code Repositories; T1596 Search Open Technical Databases

Remediation

Immediate actions

• Rotate any OpenAI, DeepSeek or other AI-platform key that has ever appeared in a web-accessible .env file, Docker configuration or Git repository
• Block and alert on traffic to 156.251.234.242 and 134.175.71.194 and on the melocc.cc domain and its subdomains
• Review AI API usage logs for requests from unfamiliar addresses and for sudden spikes in usage or balance checks

Workarounds

• Deny web-server access to dotfiles such as .env and .git
• Add secret scanning to CI and pre-commit hooks

Longer-term hardening

• Keep API keys out of web roots, container images and repositories, and use a secrets manager
• Set spending limits and usage alerts on AI API keys
• Segment campus-card and payment systems, protect student identity data and limit session-token lifetime
• Scan your own external attack surface for exposed .env files, Docker configurations and .git directories

Affected and fixed versions

• OpenAI — OpenAI API (project keys, sk-proj-)
  Vulnerable versions: Keys exposed in .env files, Docker configurations or Git repositories
  Fixed in: Rotated keys
• DeepSeek — DeepSeek API keys
  Vulnerable versions: Keys exposed in .env files, Docker configurations or Git repositories
  Fixed in: Rotated keys
• Shanghai Publishing and Printing College — Fengxian Campus student and campus-card systems
  Vulnerable versions: Student PII and campus-card data of 5,132 students
• fofa.info — Free-tier accounts abused for mass querying
  Vulnerable versions: Registered User tier (300-query web cap)

Timeline

• 2026-11-10 The VECERT Medium report returned HTTP 403 and BeaconBeagle returned HTTP 502 during research, so the GBHackers article is the only accessible source; the mail-server IP appears inconsistently (locked-ioc-2 vs 156.233.234.242).
• 2026-11-10 A GoTTY terminal branded 'Pi AI Coding Assistant' hosts a bot sending a 30-second HTTP 200 heartbeat to claim bonus points (about +10 per cycle); balances up to 252 points are cited.
• 2026-11-10 The student dataset exposes campus-card balances of up to 1,474.84 yuan together with microtransaction histories, names, student IDs, phone numbers, national ID numbers and home addresses.
• 2026-11-10 A QR-code module controlling more than 1,000 active sessions is reported as able to generate valid payment codes for high-balance campus cards.
• 2026-11-10 Evidence of a PII database of 5,132 Fengxian Campus students (Shanghai Publishing and Printing College), refreshed by a scraper every 48 hours.
• 2026-11-10 The dashboard shows validated OpenAI and DeepSeek keys, including three working DeepSeek keys with balances of 50.68, 8.52 and 0.80 units from servers such as locked-ioc-9 and locked-ioc-11.
• 2026-11-10 Control-panel screenshots and locked-ioc-1 show 1,438 confirmed fofa.info accounts with credentials and JWT tokens, registered through the catch-all locked-ioc-10 mail system.
• 2026-11-10 GBHackers reports VECERT's 'Operation Ghost Campus' investigation of an AI-driven resource-acquisition agent. The source does not state when the activity began.

Sources cited

• VECERT: Investigation - Operation Ghost Campus (cited by GBHackers; not fetched, HTTP 403) medium.com · Research
• CSA Research Note: LLMjacking Evolved - Stolen AI Compute as Offensive Infrastructure (related context) labs.cloudsecurityalliance.org · Research
• SOCRadar: KeyHunter - harvesting of LLM API keys (related context, not confirmed as the same actor) socradar.io · Blog
• AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers While Harvesting Data of 5,132 Chinese Students gbhackers.com · News · 2026-11-10
• Security Affairs: Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign (related context, not confirmed as the same actor) securityaffairs.com · News

More in threat intel

• AI Lowers the Barrier to Reverse Engineering Mainstream Software and Malware (Intezer: Slack, Apple Finder, Turla)
• CTO at NCSC Weekly Summary (week ending July 26, 2026): Cl0p PTC Windchill/FlexPLM exploitation (CVE-2026-12569), SonicWall SMA 1000 zero-days (CVE-2026-15409/CVE-2026-15410), and multi-actor state-linked activity
• AI Reward Hacking and Autonomous Sandbox Escape: OpenAI ExploitGym Evaluation Models Breach Hugging Face (Schneier DEF CON 34 Keynote Op-Ed)
• Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom
• FATF Targets Global Scam Compounds: Trafficked-Labor Fraud Operations Backed by Crypto, Instant Payments and AI-Enabled Content