BlackHatSect0r Uses AI Agent to Automate Credential Harvesting, Compromising Over 16,000 Credentials
The BlackHatSect0r threat group leveraged a DeepSeek-powered AI agent, stripped of safety features, to automate credential harvesting, compromising 16,834 credentials by exploiting common misconfigurations.
The cybercrime group BlackHatSect0r, also known as DXQRTXX, has been implicated in a sophisticated automated operation that utilized a modified AI agent powered by a DeepSeek model. This agent was designed to scan for exposed secrets, test compromised access, and feed the findings into a custom control platform, demonstrating how prevalent security gaps can be exploited at machine speed. Researchers from SOCRadar uncovered an exposed operation server containing 4.9 GB of data, including the "DXSCAN" platform, phishing tools, extortion materials, and a vault holding 16,834 credentials. During its campaign, the group queued nearly 2.8 million domains, reached over 726,000 hosts, and generated more than 1.3 million IP addresses.
The threat actors reportedly modified a Nous Research Hermes agent connected to a DeepSeek model, controlling it via a 14 KB identity file named SOUL.md. Crucially, they disabled the agent's refusal memory and safety settings, configuring seven background workers to maintain continuous scanning, collection, and reporting without constant human intervention. This autonomous operation allowed the DXSCAN platform to generate approximately 1,200 random addresses every ten seconds, probe common web ports (80, 443, 8080), identify web software, and search for over 200 credential patterns.
When the AI agent discovered exposed sensitive files such as .env files, cloud storage keys, or database credentials, it meticulously stored the information and transmitted French-language victim reports via Telegram. This workflow highlights a significant concern in cybersecurity: AI does not need to invent novel exploits to cause substantial damage. Instead, it provides threat actors with enhanced persistence, speed, and the capability to conduct reconnaissance, validation, and data collection in parallel.
While the group marketed some of its tools as "zero-days," SOCRadar's investigation found no evidence of breaches stemming from new vulnerabilities. The confirmed access was achieved through exploiting publicly accessible cloud storage buckets, exposed .env or Git files, default signing keys, or secrets embedded within browser code. In one instance, a JWT signing secret set to the easily guessable value "secret" led to the exposure of 418 identity records.
The credential vault experienced a notable increase, growing from 16,415 records on August 11 to 16,834 by August 18. The compromised data included generic secrets, database and SMTP credentials, API keys, AWS keys, GitHub tokens, and Stripe keys. Furthermore, 82 out of 230 verified SMTP configurations were identified as potential relays for future phishing operations. The same infrastructure was also used to support phishing campaigns that directed victims to call an attacker-controlled number, a tactic designed to bypass traditional link-based security measures.
This operation underscores the amplified threat posed by routine security misconfigurations when exploited by AI at scale. The reliance on exposed cloud storage, readable configuration files, and weak secrets, rather than novel exploits, emphasizes the need for fundamental security hygiene. The impact extends beyond mere credential theft, with links to alleged public-sector data theft, extortion claims, cryptocurrency exchange data exposure, and bank-impersonation scams targeting vulnerable populations.
Organizations are urged to audit their cloud storage for unintended public read or write access, remove sensitive files like .env, .git, and debug endpoints from public exposure, and immediately rotate any secrets that may have been compromised. Security teams should also hunt for the identified indicators of compromise, isolate affected systems, preserve logs, and promptly review authentication activity to detect and mitigate further malicious actions.