A French-speaking cybercriminal collective known as BlackHatSect0r, along with group DXQRTXX, has deployed a DeepSeek-based AI agent to automate widespread credential theft and infrastructure probing. The campaign harvested 16,834 exposed credentials while exploiting common misconfiguration issues rather than exploiting new vulnerabilities. This operation underscores how automation is amplifying otherwise mundane security gaps into major threats.
How the Attack Pipeline Worked
The attackers used the Nous Research Hermes agent in conjunction with the DeepSeek language model. They removed safety limits, disabled refusal-memories, and launched multiple background workers to continuously scan for weaknesses without manual oversight. Their tool, DXSCAN, generated about 1,200 random addresses every ten seconds, probing open web ports (80, 443, 8080), identifying web software, and searching through over 200 credential-pattern signatures.
Initially, exposed configuration files like.env, public cloud keys, or database credentials were identified and stored. Reports detailing potential victims—in French—were pushed out via Telegram. None of the access was achieved using newly discovered flaws. Instead, the criminals exploited exposed cloud storage, readable config files, debug endpoints, default signing keys, and simple or default credentials (e.g. JWT secrets set to trivial strings).
Scale and Impact
During the campaign, the attacker infrastructure queued nearly 2.76 million domain names, reached over 726,000 hosts, and generated about 1.37 million IPs to sweep for weaknesses. An exposed operation server housed 4.9 GB of data across 9,299 files, including the DXSCAN platform itself, phishing tools, material for extortion, and the credential vault containing 16,834 entries.
The exposed credentials encompassed generic secrets, database and SMTP access credentials, API and AWS keys, GitHub tokens, and Stripe API keys. Of 230 SMTP configurations identified, 82 were verified and prepared for reuse in phishing relays. Other abuses included extortion, data theft from public sector sources, data exposure of a cryptocurrency exchange, and impersonation calls targeting older individuals.
What Made This Possible
Several key misconfigurations made the campaign possible: public write/read access in cloud storage; presence of config files (.env,.git) and debugging or actuator endpoints exposed via the internet; default or trivially set signing keys and secrets; secrets embedded in front-end bundles or browser‐served code; weak or default SMTP setups.
The attackers’ tools removed built-in safeguards in the AI agent, undermining defensive barriers. Removing refusal memory or safety settings allowed payloads to execute that might otherwise have been blocked. Parallelization of reconnaissance, validation, and collection allowed the operation to scale with minimal human involvement.
Defensive Measures and IOCs
Security teams are urged to audit public cloud storage for improper access, eliminate or block.env and.git files from public endpoints, remove debugging and actuator interfaces exposed to the internet, and rotate all signing keys and secrets that might have been exposed.
Indicators of compromise include specific IP addresses associated with the crew’s command-and-control (C2) nodes, unusual network ports such as 8080, 9999, and 4444, presence of “SOUL.md”, “.hermes” directories, environment variables like HERMES_DISABLE_SAFETY=1, and identities such as bots on Telegram. Also, look for credential prefixes like “GHOST-VAULT-”, user agent strings referencing “GHOST-CRED/3.0” or “GHOST/0day”, and signs of ngrok or illicit dashboard or reverse shell activity.
The C2 infrastructure includes servers hosted in Moldova. Distinguished artifacts include compiled builds of DXSCAN (both release and debug) with specific SHA-256 fingerprints.
Organizations impacted most often are public sector agencies, but also cryptocurrency exchanges, banks, email service providers, and software platforms with API access. The high yield of credentials, including those for Stripe, AWS, GitHub, underscores the breadth of this campaign’s reach.
It’s worth noting that over just one week—from August 11 to August 18—the credential vault grew by over 400 entries, showing how rapidly automated campaigns like this can escalate once launched.
The campaign didn’t rely on novel exploits. Instead, it leaned into weaknesses that are often considered “low severity” by many organizations yet can be mass-exploited when an AI agent can run at scale. The gap between “should fix” and “urgent patch” is shrinking fast.
As background,.env files are typically used to store credentials or API secrets for services like databases, SMTP, cloud keys, etc. Their exposure is one of the easiest misconfigurations for automated scanners to detect and exploit. Debug endpoints or Git files unintentionally left accessible can allow attackers to reconstruct secrets and past development history. Default JWT signing secrets or trivial values (“secret”) are frequently abused. Recognizing this ecosystem of weaknesses is essential because it shows that most defenses start failing when attackers use agents to automate every step.
This case represents an important milestone in adversarial use of AI agents. It blends reconnaissance, exploitation, credential theft, and reporting in a pipeline that minimizes time and manual labor. AI allows threats like this to run unchecked at a speed humans simply can’t match. Reported impacts across sectors make it clear: any organization skipping the basics of credential hygiene, cloud config auditing, or secret management is at extreme risk. The real lesson may be that stopping new vulnerabilities matters less if misconfigurations are everywhere and automated AI tools can find them in minutes.
