[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1zQpx8SN65zvSQ_ly0Tegke0NrVUnW0-P_U5tkqtn4E":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"0df9fa97-39f2-4dc2-b5d6-cec84ac78b53","Hackers Use 1,438 Fake FOFA Accounts to Steal OpenAI and DeepSeek API Keys Across the Internet","hackers-use-1-438-fake-fofa-accounts-to-steal-openai-and-deepseek-api-keys-acros-a74276","A threat actor has built an automated system that registers fake accounts on the FOFA search engine, scans the internet for leaked AI keys, and tests them for free use. The operation relies on 1,438 fake FOFA accounts to find exposed OpenAI and DeepSeek API keys on misconfigured servers. The stolen keys power the attacker’s […] The post Hackers Use 1,438 Fake FOFA Accounts to Steal OpenAI and DeepSeek API Keys Across the Internet appeared first on Cyber Security News.","A threat actor has automated the registration of 1,438 fake accounts on the FOFA search engine to scan for and steal exposed OpenAI and DeepSeek API keys from misconfigured servers. These stolen keys are then used to power the attacker's own AI tools and scripts, potentially leading to unexpected bills for victims. The operation, tracked as VECERT-TI-2026-1107-B and linked to Operation Ghost-Campus, may be based in China.","Hackers use 1,438 fake FOFA accounts to steal OpenAI and DeepSeek API keys.","https:\u002F\u002Fcybersecuritynews.com\u002Ffake-fofa-accounts\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-1438-Fake-FOFA-Accounts-to-Steal-OpenAI-and-DeepSeek-API-Keys-Across-the-Internet.webp","2026-11-10T09:39:54+00:00","2026-11-10T10:00:40.674163+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"OpenAI API","product",{"name":21,"type":19},"DeepSeek API",{"name":23,"type":24},"FOFA","technology",{"name":26,"type":27},"VECERT","threat_actor",{"name":29,"type":30},"Operation Ghost-Campus","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":56,"value":57,"context":58},"domain","melocc.cc","Private 'catch-all' email system used by the attacker for account registration.",[18,21],{"controls":61,"vendors":148},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":35,"name":92,"problem":93,"products":94},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":120,"name":121,"problem":122,"products":123},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"1438-fake-fofa-accounts-used-to-harvest-exposed-ai-api-keys","1,438 Fake FOFA Accounts Used to Harvest Exposed AI API Keys","Threat actors systematically exploited misconfigured servers that left OpenAI and DeepSeek API keys publicly exposed, automating the harvesting process at scale through fake FOFA search engine accounts. The root failure was a configuration management problem: developers and organizations failed to secure their API keys, leaving them discoverable by internet-wide scanning tools. This matters because stolen API keys grant unauthorized access to powerful AI services, resulting in financial harm through unexpected billing and potential misuse of AI capabilities for malicious purposes. At scale, this type of credential harvesting represents a low-effort, high-reward attack that is trivially repeatable as long as keys remain exposed.",[154,155,156,157,158,159,160],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","GDPR Article 32",{"GDPR Article 32":162,"MITRE ATT&CK T1566: Phishing":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"CIS Control 17: Incident Response Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"If the exposed API keys provided access to systems processing personal data, the failure to implement appropriate technical measures to secure those credentials constitutes a breach of the obligation to ensure security appropriate to the risk.","While not phishing in the traditional sense, the mass creation of 1,438 fake FOFA accounts represents a credential and access harvesting operation through deceptive account abuse, paralleling the scaled deception tactics this technique category addresses.","Exposed credentials represent a known remediable flaw; systematic identification and remediation processes would have flagged and corrected these misconfigurations before attackers exploited them.","Victims had no mechanism to detect that their API keys were stolen and being actively abused; a mature incident response capability with anomaly alerting would have identified the unauthorized usage rapidly.","Misconfigured servers leaking API keys represent a technical vulnerability that should be identified and remediated through a formal vulnerability management process aligned with this control.","Servers were misconfigured to expose API keys publicly; enforcing secure baseline configurations would have prevented credentials from being accessible to internet scanners.","API keys function as authentication credentials; proper lifecycle management, scoping, and rotation of these keys is exactly what this control requires and would have limited attacker access."]