VERCEL · CMP-202611-iqc2sf · Infrastructure
NO FIX YET · SEE WHAT TO DO
SOCRadar's threat research unit tracked an operation it calls KeyHunter, run by a Chinese-speaking actor, leepsmarts. Automated scanners (FOFA/Shodan seeds, crt.sh, Wayback Machine snapshots, GitHub repo key scanning) look for exposed .env and config files on apps hosted on Vercel, Netlify, Railway, Render, Replit, Streamlit, Fly.io, Cloudflare Pages, Koyeb and Deta. Since 10 Jul 2026 the actor has collected 2,233 API keys (Anthropic, OpenAI, Google, DeepSeek, OpenRouter, AWS/GCP/Azure, Stripe sk_live), of which 12 were valid, and listed 247 unauthenticated LLM gateways (one-api/new-api, open OpenAI-compatible endpoints), 223 of them usable. Stolen Stripe keys are used to test stolen cards. The same actor runs a crypto drainer and fake student accounts at US universities. AI agents (Hermes Agent, OpenClaw, PentAGI) run the work. Last activity confirmed 13 Oct 2026. Which organisations the valid keys came from is unknown.
first public Nov 4, 2026 · 1 source
Use Vercel? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Who cares campaign
Posts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202611-iqc2sf")