---
id: "CMP-202611-iqc2sf"
kind: "campaign"
aliases: []
title: "KeyHunter: Chinese-speaking actor leepsmarts scans Vercel, Netlify, Railway and other hosted apps for exposed .env files to steal AI, cloud and Stripe keys (SOCRadar)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Vercel", "fixed": [], "ecosystem": "vendor"}, {"name": "Netlify", "fixed": [], "ecosystem": "vendor"}, {"name": "Railway", "fixed": [], "ecosystem": "vendor"}, {"name": "Render", "fixed": [], "ecosystem": "vendor"}, {"name": "Replit", "fixed": [], "ecosystem": "vendor"}, {"name": "Streamlit", "fixed": [], "ecosystem": "vendor"}, {"name": "Fly.io", "fixed": [], "ecosystem": "vendor"}, {"name": "Cloudflare Pages", "fixed": [], "ecosystem": "vendor"}, {"name": "one-api", "fixed": [], "ecosystem": "vendor"}, {"name": "new-api", "fixed": [], "ecosystem": "vendor"}, {"name": "Stripe API", "fixed": [], "ecosystem": "vendor"}, {"name": "Anthropic API", "fixed": [], "ecosystem": "vendor"}, {"name": "OpenAI API", "fixed": [], "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T14:24:50+00:00"
updated_at: "2026-11-04T14:26:34+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T14:24:50+00:00"}]
---

# KeyHunter: Chinese-speaking actor leepsmarts scans Vercel, Netlify, Railway and other hosted apps for exposed .env files to steal AI, cloud and Stripe keys (SOCRadar)

SOCRadar's threat research unit tracked an operation it calls KeyHunter, run by a Chinese-speaking actor, leepsmarts. Automated scanners (FOFA/Shodan seeds, crt.sh, Wayback Machine snapshots, GitHub repo key scanning) look for exposed .env and config files on apps hosted on Vercel, Netlify, Railway, Render, Replit, Streamlit, Fly.io, Cloudflare Pages, Koyeb and Deta. Since 10 Jul 2026 the actor has collected 2,233 API keys (Anthropic, OpenAI, Google, DeepSeek, OpenRouter, AWS/GCP/Azure, Stripe sk_live), of which 12 were valid, and listed 247 unauthenticated LLM gateways (one-api/new-api, open OpenAI-compatible endpoints), 223 of them usable. Stolen Stripe keys are used to test stolen cards. The same actor runs a crypto drainer and fake student accounts at US universities. AI agents (Hermes Agent, OpenClaw, PentAGI) run the work. Last activity confirmed 13 Oct 2026. Which organisations the valid keys came from is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Vercel affected ? fixed ?
- vendor:Netlify affected ? fixed ?
- vendor:Railway affected ? fixed ?
- vendor:Render affected ? fixed ?
- vendor:Replit affected ? fixed ?
- vendor:Streamlit affected ? fixed ?
- vendor:Fly.io affected ? fixed ?
- vendor:Cloudflare Pages affected ? fixed ?
- vendor:one-api affected ? fixed ?
- vendor:new-api affected ? fixed ?
- vendor:Stripe API affected ? fixed ?
- vendor:Anthropic API affected ? fixed ?
- vendor:OpenAI API affected ? fixed ?

## How to check

- In web and CDN logs, look for requests to /.env, .env.development, .env.prod, .env.staging, .env.backup, .env~, /api/env, /_next/env.js, /.vercel/output/config.json, /.netlify/functions-serve/env, /netlify.toml, /railway.json, /render.yaml, /.replit, /replit.nix, /.streamlit/secrets.toml, /secrets.toml, /fly.toml, /wrangler.toml, /_worker.js, /config.yaml, /env.json, /firebase.json, /serverless.yml, and check that none of these return content.
- Look for traffic from actor infrastructure: 209.112.91[.]74, 173.231.39[.]244, 123.60.2[.]245, 14.47.118[.]194, 66.42.94[.]67, 159.89.18[.]165; domains senhai[.]store, astrdark[.]cyou, xxtt[.]me, sajuai[.]xyz, web.712019[.]xyz, mail2.bfvdoor[.]com, new74.osxwrong.us[.]com, vvbin[.]me (used for throwaway email sign-ups).
- Check whether any self-hosted one-api/new-api or other OpenAI-compatible LLM gateway is reachable without auth.
- Check Wayback Machine snapshots of your domains for .env files that were exposed in the past.
- Review AI provider, cloud and Stripe usage for keys used from unknown IPs.

## Fix

- Make sure no .env or secrets/config file is served by any deployed app; take secrets out of client bundles (/_next/env.js, public env) and build output.
- Rotate any AI provider, cloud, OpenRouter or Stripe key that was ever in a served file, a public repo or an archived snapshot.
- Put authentication in front of LLM gateways (one-api, new-api, LiteLLM-style proxies) and set spend limits on AI provider keys.
- Block the listed IPs and domains.

## Timeline

- 2026-11-04T14:24:50+00:00 analyst

## Documents

- [describes] Kevin Beaumont: Actually credible, well evidenced research into a crimeware guy using AI assiste https://cyberplace.social/@GossiTheDog/117558485378104303
- [describes] Kevin Beaumont: Can't have some crimeware without putting all your stuff in an open web director https://cyberplace.social/@GossiTheDog/117558488525745654
- [describes] KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft (SOCRadar STRU) https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_