{"id":"CMP-202611-iqc2sf","kind":"campaign","aliases":[],"related":[],"title":"KeyHunter: Chinese-speaking actor leepsmarts scans Vercel, Netlify, Railway and other hosted apps for exposed .env files to steal AI, cloud and Stripe keys (SOCRadar)","description":null,"summary":"SOCRadar's threat research unit tracked an operation it calls KeyHunter, run by a Chinese-speaking actor, leepsmarts. Automated scanners (FOFA/Shodan seeds, crt.sh, Wayback Machine snapshots, GitHub repo key scanning) look for exposed .env and config files on apps hosted on Vercel, Netlify, Railway, Render, Replit, Streamlit, Fly.io, Cloudflare Pages, Koyeb and Deta. Since 10 Jul 2026 the actor has collected 2,233 API keys (Anthropic, OpenAI, Google, DeepSeek, OpenRouter, AWS/GCP/Azure, Stripe sk_live), of which 12 were valid, and listed 247 unauthenticated LLM gateways (one-api/new-api, open OpenAI-compatible endpoints), 223 of them usable. Stolen Stripe keys are used to test stolen cards. The same actor runs a crypto drainer and fake student accounts at US universities. AI agents (Hermes Agent, OpenClaw, PentAGI) run the work. Last activity confirmed 13 Oct 2026. Which organisations the valid keys came from is unknown.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T14:24:50+00:00","products":[{"name":"Vercel","fixed":[],"ecosystem":"vendor"},{"name":"Netlify","fixed":[],"ecosystem":"vendor"},{"name":"Railway","fixed":[],"ecosystem":"vendor"},{"name":"Render","fixed":[],"ecosystem":"vendor"},{"name":"Replit","fixed":[],"ecosystem":"vendor"},{"name":"Streamlit","fixed":[],"ecosystem":"vendor"},{"name":"Fly.io","fixed":[],"ecosystem":"vendor"},{"name":"Cloudflare Pages","fixed":[],"ecosystem":"vendor"},{"name":"one-api","fixed":[],"ecosystem":"vendor"},{"name":"new-api","fixed":[],"ecosystem":"vendor"},{"name":"Stripe API","fixed":[],"ecosystem":"vendor"},{"name":"Anthropic API","fixed":[],"ecosystem":"vendor"},{"name":"OpenAI API","fixed":[],"ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- In web and CDN logs, look for requests to /.env, .env.development, .env.prod, .env.staging, .env.backup, .env~, /api/env, /_next/env.js, /.vercel/output/config.json, /.netlify/functions-serve/env, /netlify.toml, /railway.json, /render.yaml, /.replit, /replit.nix, /.streamlit/secrets.toml, /secrets.toml, /fly.toml, /wrangler.toml, /_worker.js, /config.yaml, /env.json, /firebase.json, /serverless.yml, and check that none of these return content.\n- Look for traffic from actor infrastructure: 209.112.91[.]74, 173.231.39[.]244, 123.60.2[.]245, 14.47.118[.]194, 66.42.94[.]67, 159.89.18[.]165; domains senhai[.]store, astrdark[.]cyou, xxtt[.]me, sajuai[.]xyz, web.712019[.]xyz, mail2.bfvdoor[.]com, new74.osxwrong.us[.]com, vvbin[.]me (used for throwaway email sign-ups).\n- Check whether any self-hosted one-api/new-api or other OpenAI-compatible LLM gateway is reachable without auth.\n- Check Wayback Machine snapshots of your domains for .env files that were exposed in the past.\n- Review AI provider, cloud and Stripe usage for keys used from unknown IPs.","fix":"- Make sure no .env or secrets/config file is served by any deployed app; take secrets out of client bundles (/_next/env.js, public env) and build output.\n- Rotate any AI provider, cloud, OpenRouter or Stripe key that was ever in a served file, a public repo or an archived snapshot.\n- Put authentication in front of LLM gateways (one-api, new-api, LiteLLM-style proxies) and set spend limits on AI provider keys.\n- Block the listed IPs and domains.","status":"open","published_at":null,"first_seen_at":"2026-11-04T14:24:50+00:00","triaged_at":"2026-11-04T14:24:50+00:00","updated_at":"2026-11-04T14:26:34+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':28A '/new-api':146B '10':112B '12':134B '13':191B '2':119B '2026':114B,193B '223':152B '233':120B '247':139B 'account':175B 'activ':189B 'actor':5A,74B,116B,167B 'agent':180B,182B 'ai':21A,179B 'anthrop':123B 'anthropic':49A 'api':43A,46A,48A,50A,52A,121B,145B 'app':14A,96B 'autom':76B 'aws/gcp/azure':128B 'call':66B 'came':199B 'campaign':53B 'card':164B 'chines':3A,72B 'chinese-speak':2A,71B 'cloud':22A 'cloudflar':106B 'cloudflare':39A 'cmp':27A 'collect':118B 'compat':150B 'config':93B 'confirm':190B 'crt.sh':80B 'crypto':170B 'deepseek':126B 'deta':110B 'drainer':171B 'earli':55B 'early-warn':54B 'endpoint':151B 'env':17A,91B 'expos':16A,90B 'fake':173B 'file':18A,94B 'fly.io':38A,105B 'fofa/shodan':78B 'gateway':142B 'github':84B 'googl':125B 'herm':181B 'host':13A,97B 'iqc2sf':29A 'jul':113B 'key':25A,86B,122B,158B,198B 'keyhunt':1A,67B 'keyhunter':30A 'koyeb':108B 'last':188B 'leepsmart':6A,75B 'leepsmarts':31A 'list':138B 'live':131B 'llm':141B 'look':88B 'machin':82B 'netlifi':9A,100B 'netlify':33A 'new':45A 'new-api':44A 'oct':192B 'one':42A,144B 'one-api':41A,143B 'open':147B 'openai':51A,124B,149B 'openai-compat':148B 'openclaw':183B 'openrout':127B 'oper':64B 'organis':195B 'page':107B 'pages':40A 'pentagi':184B 'railway':10A,34A,101B 'render':35A,102B 'replit':36A,103B 'repo':85B 'research':60B 'run':68B,168B,185B 'scan':7A,87B 'scanner':77B 'seed':79B 'sinc':111B 'sk':130B 'snapshot':83B 'socradar':26A,57B 'speak':4A,73B 'steal':20A 'stolen':156B,163B 'streamlit':37A,104B 'stripe':24A,47A,129B,157B 'student':174B 'test':162B 'threat':59B 'track':62B 'unauthent':140B 'unit':61B 'univers':178B 'unknown':202B 'us':177B 'usabl':155B 'use':160B 'valid':136B,197B 'vercel':8A,32A,99B 'warn':56B 'wayback':81B 'work':187B","nicknames":["KeyHunter","leepsmarts"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["anthropicapi","api","cloudflarepages","flyio","keyhunter","leepsmarts","netlify","newapi","oneapi","openaiapi","pages","railway","render","replit","streamlit","stripeapi","vercel"],"ptokens":["anthropic","api","cloudflare","fly","io","netlify","new","one","openai","pages","railway","render","replit","streamlit","stripe","vercel"],"labels":["campaign","earlywarning","infrastructure","medium"],"campaign_type":"breach","first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-iqc2sf","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T14:24:50+00:00","fetched_at":"2026-11-04T14:24:50+00:00","note":null}],"documents":[{"id":67318,"url":"https://cyberplace.social/@GossiTheDog/117558485378104303","title":"Kevin Beaumont: Actually credible, well evidenced research into a crimeware guy using AI assiste","kind":"post","source":"mastodon","publisher":null,"text":"Actually credible, well evidenced research into a crimeware guy using AI assisted tooling from SOCRadar, this is a good report if you like nerdy stuff The threat actor left all their stuff in an open web directory (lol) hence all the evidence. Their primary thing was taking AI keys from .env files (lol). They used things like Grok to try to get into orgs. They were not very successful. https:// socradar.io/blog/keyhunter-ope ration-harvard-alumni-stanford-llm-key-data/","published_at":"2026-11-04T13:48:50+00:00","relation":"describes","confidence":null,"note":null},{"id":67317,"url":"https://cyberplace.social/@GossiTheDog/117558488525745654","title":"Kevin Beaumont: Can't have some crimeware without putting all your stuff in an open web director","kind":"post","source":"mastodon","publisher":null,"text":"Can't have some crimeware without putting all your stuff in an open web directory.","published_at":"2026-11-04T13:49:38+00:00","relation":"describes","confidence":null,"note":null},{"id":67439,"url":"https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/","title":"KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft (SOCRadar STRU)","kind":"blog","source":"analyst","publisher":null,"text":"SOCRadar STRU attributes KeyHunter to Chinese-speaking actor leepsmarts (@leepsmartsx), active Jan-Oct 13 2026. env_hunter v4.0 scans exposed .env and config files on Vercel, Netlify, Railway, Render, Replit, Streamlit, Fly.io, Cloudflare Pages, koyeb, deta (paths incl. /api/env, /_next/env.js, /.vercel/output/config.json, /netlify.toml, /railway.json, /render.yaml, /.replit, /.streamlit/secrets.toml, /fly.toml, /wrangler.toml, /_worker.js, .env.development/.env.prod/.env.staging/.env.backup, /firebase.json, /serverless.yml); also Wayback Machine snapshots and GitHub repo scanning (fork of fadidevv/keyhunter). 2,233 keys harvested since 2026-07-10 (Anthropic, OpenAI, Google, DeepSeek, AWS/GCP/Azure, OpenRouter, Stripe sk_live), 12 valid; 247 exposed LLM gateways (one-api/new-api, open OpenAI-compatible endpoints), 223 usable. Stolen Stripe keys used to validate stolen cards; Harmony ONE crypto drainer; academic fraud at 20 universities. Infra: 209.112.91[.]74 (:8899, dashboard :9997), 173.231.39[.]244, 123.60.2[.]245, 14.47.118[.]194, 66.42.94[.]67, 159.89.18[.]165; domains senhai[.]store, astrdark[.]cyou, xxtt[.]me, sajuai[.]xyz, web.712019[.]xyz, mail2.bfvdoor[.]com, new74.osxwrong.us[.]com, vvbin[.]me. Uses Hermes Agent, OpenClaw, PentAGI, grok-4.6.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}