Cybersecurity researchers uncovered a large-scale operation using 1,438 fraudulent FOFA search‐engine accounts to commandeer exposed OpenAI and DeepSeek API keys across the internet. The attacker’s fully automated pipeline registers fake accounts, hunts for misconfigured servers with leaked credentials, and tests each key to see if it’s still active—a classic case of automation enabling theft at scale.
How the Scam Works
FOFA is a web search platform that indexes internet‐facing devices and services. Free users receive few daily search queries, which prompted the attacker to create nearly 1,500 free accounts to work around those limits. All are “Registered User” level, equipped with minimal privileges and fewer than 300 queries each—yet used in rotation to power tens of thousands of searches per day.
The fraudsters operate a catch‐all email domain called melocc.cc and its subdomains (mail, api, pop, imap, smtp), all directed at a single server. A script creates FOFA accounts, handles confirmation emails, and activates them in seconds without human help. On the compromised server, analysts found a file named fofa_accounts.csv containing credentials and API tokens spanning all fake accounts.
Stealing API Keys and Cashing In
These accounts are used to scour the open internet: checking for exposed .env files, Docker configurations, and unsecured Git repositories, all known sources of accidentally leaked secrets. When potentially valid API keys are sniffed out, the attacker verifies them using specific patterns. OpenAI keys beginning with sk-proj- are tested at the official OpenAI API endpoint, while DeepSeek keys matching sk-[a-f0-9]{32} are evaluated similarly to assess remaining credit balances.
During one surfacing, investigators observed eight “high‐value” credentials and three usable DeepSeek API keys with non‐trivial balances (roughly 50.68, 8.52, and 0.80 units of currency or credit). Some were traced to domains like labibiyat.com and nyisu.com.
Impact & Collateral Damage
The pilfered keys feed AI tools running on attacker infrastructure. These include an interactive terminal called “Pi – AI Coding Assistant,” and other scripts that rely on stolen compute and model access. Victims may face unexpected bills, drained credit balances, or the misuse of their identities in usage logs, since the attacker’s operations mask themselves as legitimate use of the victim’s API credentials.
Personal data theft was also involved: A server in Shanghai linked to this operation collected data on over 5,000 students, including names, phone numbers, national IDs, addresses, and campus card balances. A scraper refreshed this information every 48 hours, while bots generated fake reading activity to game campus participation systems.
Indicators & Defense Measures
Some of the artifacts linked to the intrusion include the melocc.cc domain and its subdomains as part of the mail infrastructure used to register FOFA accounts. The attacker’s control panel and the file listing fake credentials were found on servers associated with Tencent Cloud in Guangzhou, China. Known compromised domains also include labibiyat.com and nyisu.com.
Defensive steps include revoking or rotating any potentially exposed keys, monitoring API usage for anomalies (such as spikes in volume or requests from unexpected locations), and establishing spending limits on AI service accounts. It’s also crucial to avoid storing secrets in public .env files, misconfigured Docker containers, or unsecured source code repositories.
This reveals just how low-cost and high-margin credential theft has become, especially in an era where automation, AI tools, and public search engines combine to scale small mishaps into major threats. For organizations and developers, vigilance around secret management and proactive infrastructure hygiene are no longer optional—they’re essential.
