# Operation Ghost Campus: AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers and Harvest Data of 5,132 Chinese Students

> An AI-driven resource-acquisition agent farms 1,438 free fofa.info accounts through a catch-all mail domain (melocc.cc), uses them to search for exposed .env files, Docker configurations and Git repositories, and extracts and validates OpenAI and DeepSeek API keys. A companion module holds a PII database of 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, and a QR-code module could generate valid campus-card payment codes. The research was originally published by VECERT and reported by GBHackers on 2026-11-10; no actor is named.

- **Published:** 2026-11-10T08:03:35Z
- **Last reviewed:** 2026-11-10T08:03:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5626
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5626.png
- **ID:** TL-2026-5626
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (3 shown free below)

## Description

Operation Ghost Campus is the name VECERT gave to an investigation, reported by GBHackers on 2026-11-10, into an AI-driven resource-acquisition agent. The agent combines large-scale free-tier abuse of the fofa.info internet-asset search engine, harvesting of AI-platform API keys from misconfigured servers, and scraping of a Chinese university campus-card system. The source does not state when the activity began and does not name an actor.

Account farming: the operator avoided public disposable-mail services and ran its own catch-all mail system on melocc.cc. The subdomains mail, api, pop, imap and smtp all resolve to 156.251.234.242, a US server from Cognetcloud INC (ASN 401701). A script registers a fofa.info account, reads the confirmation email over the operator's own POP/IMAP service, extracts the activation link and activates the account within seconds. Control-panel screenshots show 1,438 confirmed accounts stored in fofa_accounts.csv, which holds account credentials and JWT tokens. Each account is a low-tier 'Registered User' with no F-points and a 300-query web cap. Rotating all tokens yields tens of thousands of free queries per day.

Secret hunting and key validation: the fofa queries target exposed .env files, Docker configurations and poorly secured Git repositories. Regular expressions pull AI-platform keys from the exposed hosts and sort them. OpenAI project keys (sk-proj-) are tested against api.openai.com. HTTP 429 with no credits is tagged valid_no_balance and HTTP 401 is tagged revoked. The article notes that a 429 can also mean rate limiting, so this tagging can misclassify keys. DeepSeek keys match sk-[a-f0-9]{32} and are checked through GET /user/balance. The dashboard listed three working DeepSeek keys with balances of 50.68, 8.52 and 0.80 units, taken from servers including labibiyat.com and nyisu.com. The attacker control server is 134.175.71.194, a Tencent Cloud VPS in Guangzhou.

Monetization and fraud: stolen tokens power a GoTTY terminal branded 'Pi AI Coding Assistant'. It supports scripts for a fake-engagement bot that sends an HTTP 200 heartbeat every 30 seconds to imitate an active reading session. The bot claims bonus points through an internal API (about +10 per cycle) and checks whether the account has been frozen. Balances up to 252 points are cited. A second module holds a PII database of 5,132 students at the Fengxian Campus of the Shanghai Publishing and Printing College, mostly born 2006 to 2008. It covers names, student IDs, phone numbers, national ID numbers, home addresses, campus-card balances and microtransaction histories, and the scraper refreshes every 48 hours. A QR-code module controls more than 1,000 active sessions and, according to the article, could generate valid payment codes for high-balance campus cards, enabling in-person fraud.

Caveats: the GBHackers article gives the mail server IP as 156.233.234.242 in one place, which conflicts with 156.251.234.242 and is treated as unverified and excluded from the IOCs. The VECERT Medium report returned HTTP 403 and BeaconBeagle returned HTTP 502 during research, so the article is the only primary source. No CVE, CVSS score or file hashes are given.

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T1593.003 Code Repositories
- T1589.001 Gather Victim Identity Information: Credentials
- T1585 Establish Accounts
- T1583.001 Acquire Infrastructure: Domains
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1078 Valid Accounts
- T1552.001 Unsecured Credentials: Credentials In Files
- T1119 Automated Collection
- T1496.004 Resource Hijacking: Cloud Service Hijacking
- T1657 Financial Theft
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Operation Ghost Campus (TL-2026-5626) - Exposed .env / Docker Config Retrieved Over HTTP** (`TL-2026-5626-SPL-001`)

Detects successful (HTTP 200) retrieval of .env files, docker-compose files, Dockerfiles or .docker/config.json from web servers you operate. Operation Ghost Campus (TL-2026-5626) finds exactly these exposed files via fofa.info queries and regex-extracts OpenAI (sk-proj-) and DeepSeek (sk-[a-f0-9]{32}) API keys from them (CWE-538, CWE-522; ATT&CK T1552.001). A 200 on these paths means the secrets file is publicly readable and every key inside must be treated as compromised and rotated.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1552.001, T1596
- **Data sources:** web_server_access_logs, index=web sourcetype=access_combined, W3CIISLog
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined status=200
| eval path=lower(coalesce(uri_path, uri))
| where match(path, "(^|/)([.]env([.][a-z0-9_-]+)?|docker-compose[.]ya?ml|dockerfile|[.]docker/config[.]json)$")
| stats count AS hits dc(path) AS distinct_paths values(path) AS paths values(useragent) AS user_agents min(_time) AS first_seen max(_time) AS last_seen BY clientip, host
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - hits
```

### Microsoft KQL

```kql
W3CIISLog
| where TimeGenerated > ago(24h)
| where scStatus == '200'
| extend path = tolower(csUriStem)
| where path matches regex '(^|/)([.]env([.][a-z0-9_-]+)?|docker-compose[.]ya?ml|dockerfile|[.]docker/config[.]json)$'
| summarize Hits = count(), DistinctPaths = dcount(path), Paths = make_set(path, 20), UserAgents = make_set(csUserAgent, 5), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, sSiteName, Computer
| project FirstSeen, LastSeen, cIP, sSiteName, Computer, Hits, DistinctPaths, Paths, UserAgents
| order by Hits desc
```

### Sigma

```yaml
title: Operation Ghost Campus - Exposed .env or Docker Configuration File Retrieved
id: 3f6a1c52-8d47-4b19-a0e3-5c2b7d9e4a11
status: experimental
description: Detects HTTP 200 responses for .env, docker-compose and Docker config files. TL-2026-5626 (Operation Ghost Campus) harvests OpenAI and DeepSeek API keys from such exposed files.
references:
    - https://gbhackers.com/ai-powered-data-theft/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.credential-access
    - attack.t1552.001
    - attack.reconnaissance
    - attack.t1596
logsource:
    category: webserver
detection:
    selection:
        c-uri|endswith:
            - '/.env'
            - '/.env.local'
            - '/.env.production'
            - '/.env.dev'
            - '/.env.bak'
            - '/docker-compose.yml'
            - '/docker-compose.yaml'
            - '/Dockerfile'
            - '/.docker/config.json'
        sc-status: 200
    condition: selection
falsepositives:
    - Authorized external attack-surface scanners or pentests
    - Intentionally published example configuration files
level: high
```

**Known false positives:**

- Authorized external vulnerability scanners and pentest engagements requesting these paths
- Intentionally published sample .env.example style files that contain no secrets

**Tuning notes:** Point index/sourcetype at your real web log source (nginx/Apache access_combined or IIS ms:iis:auto). Exclude approved scanner source IPs via a lookup. Any 200 on these paths from an unapproved client is a finding: remove the file from the web root, block dotfiles at the server, and rotate every key it contained.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Operation Ghost Campus - Exposed .git Repository Metadata Retrieved (locked: unlock with TL Creds)
- Operation Ghost Campus - API Key Validation Command (DeepSeek /user/balance, OpenAI sk-proj-) (locked: unlock with TL Creds)
- Operation Ghost Campus - Mail Protocol Traffic to [indicator] Catch-All Mail Server (locked: unlock with TL Creds)
- Operation Ghost Campus - Scripted Client Harvesting Secret Files From Web Server (locked: unlock with TL Creds)
- Operation Ghost Campus - GoTTY Web Terminal Started With Write Access (locked: unlock with TL Creds)
- Operation Ghost Campus - DNS Query for [indicator] Infrastructure (locked: unlock with TL Creds)
- Operation Ghost Campus - Non-Browser Process Calling OpenAI/DeepSeek API (Key Validation) (locked: unlock with TL Creds)
- Operation Ghost Campus - Connection to Attacker Control Server [indicator] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 15)

Defanged, TLP:CLEAR.

- IP address: `156.251.234[.]242`
- Domain: `melocc[.]cc`
- IP address: `134.175.71[.]194`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers While Harvesting Data of 5,132 Chinese Students](https://gbhackers.com/ai-powered-data-theft/)
- [VECERT: Investigation - Operation Ghost Campus (cited by GBHackers; not fetched, HTTP 403)](https://medium.com/@vecert/investigation-operation-ghost-campus-artificial-intelligence-agents-academic-fraud-and-global-0ea0ded1e688)
- [CSA Research Note: LLMjacking Evolved - Stolen AI Compute as Offensive Infrastructure (related context)](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-offensive-agentic-infrastructur/)
- [SOCRadar: KeyHunter - harvesting of LLM API keys (related context, not confirmed as the same actor)](https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/)
- [Security Affairs: Chinese Hackers Use AI Agents in Multi-Country Cyber Campaign (related context, not confirmed as the same actor)](https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5626