AI Agents Steal OpenAI and DeepSeek API Keys From Exposed Servers While Harvesting Data of 5,132 Chinese Students

VECERT researchers have documented an AI-driven operation that hunts exposed servers for OpenAI and DeepSeek API keys, using more than 1,400 fraudulently registered accounts on the FOFA asset-search service to find exposed .env files, Docker configurations and Git repositories. The stolen keys power a fake-activity bot used for academic fraud, and investigators also found a database covering 5,132 students at a Shanghai college campus, including names, student and national ID numbers, phone numbers, home addresses, and campus-card balances and transaction histories.