Threat Intelligence

KeyHunter Operation: Stolen AI Keys and a Fraud Campaign Aimed at 20 Universities

SOCRadar · 4 Nov 2026

Key Takeaway Check that your cloud services are not misconfigured and that AI service API keys are stored securely, restricted and rotated, so they cannot be harvested and abused.

SOCRadar's Threat Research Unit has detailed the KeyHunter Operation, which combines the theft of large language model (LLM) API credentials with an academic fraud campaign. The researchers attribute it to a Chinese-speaking actor known as leepsmarts, with activity confirmed as late as October 13, 2026. The fraud campaign targets 20 institutions, 19 of them in the US, and reaches Harvard alumni data, Stanford applications and 18 other universities.

The operation has two main tracks: stealing LLM API credentials from misconfigured cloud infrastructure, and the university fraud effort. Both run on infrastructure in China, South Korea, Malaysia and the US. They are coordinated through AI agent frameworks (Hermes Agent and OpenClaw) and managed from a custom dashboard on the actor's primary server.

The actor's own mistake gave researchers a window in. Directory listing was enabled on the primary server, exposing tools, scripts, logs and Telegram bot tokens, including tokens for the actor's AI agent bots. Chat history behind those bots goes back to at least January 2026. On September 9, 2026, SOCRadar detected the server with 110 files across 37 directories exposed. Pivoting from it, using a shared certificate, related domains, bot tokens and file links, researchers connected the server to 22 hosts. Six were classed as actor infrastructure and 16 as scanning targets.

LLM key theft academic fraud threat intelligence AI agents cloud misconfiguration

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.