Threat video1:00
Operation Ghost Campus AI API Key Theft: Detection & IOCs
AI agents farm 1,438 accounts to find exposed .env files and steal OpenAI and DeepSeek keys. Includes 9 detection rules, 15 IOCs and a free Splunk SPL rule.
Read the full threat intel for Operation Ghost Campus AI API Key Theft: Detection & IOCs →
Chapters
- 0:00The hookReportedly, an AI agent farmed 1,438 accounts.
- 0:06The storyIt harvested keys from exposed hosts.
- 0:12Attack pathIt reportedly ran its own catch-all mail.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise13 indicators to hunt: 2 IPs, 8 domains and 1 file name, and more.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation3 steps now: Rotate any OpenAI, DeepSeek or other AI-platform key that has.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Reportedly, an AI agent farmed 1,438 accounts.
0:06It harvested keys from exposed hosts.
0:09Then it validated the keys.
0:12It reportedly ran its own catch-all mail.
0:15Then it hunted exposed hosts.
0:17A module held a database of 5,132 students.
0:22A QR module could generate campus payment codes.
0:28No threat actor is attributed. Confidence: low.
0:3213 indicators to hunt: 2 IPs, 8 domains and 1 file name, and more.
0:3912 ATT&CK techniques, from reconnaissance to impact.
0:433 steps now: Rotate any OpenAI, DeepSeek or other AI-platform key that has.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.