Observed incident

Recovered DeepSeek sessions document targeting of a European telecom

Reported

Published here

What happened

Malbear Labs examined an operator workspace containing about 70 DeepSeek Flash session transcripts. The records describe more than two weeks of activity directed at a European telecom and organizations it hosted. A human set objectives and checked results while the agent carried out tasks.

Parties and reporting

Where this happened

Targeted or attempted, compromise not established:
Europe (broad region)

Countries and regions are approximate and come from the sources, not from attacker, vendor or researcher locations. See this report’s footprint on the world map.

AI tools and systems: DeepSeek Flash, Operator-directed agent framework

Outcome

Malbear reports that the workspace showed access to thousands of subscriber billing and device records. The agent listed 13 hosted organizations in scope. The report gives no victim-side confirmation of how many organizations were compromised or what was recovered.

Operating lesson

Check access to billing and hosted customer systems against provider-side audit logs. Distinguish records actually retrieved from systems an agent merely listed as targets.

Evidence and limits

Malbear published its analysis on November 8 using records from the operator’s side. It did not identify the telecom, establish an exact campaign start date or report victim remediation. The language of the transcripts does not establish who directed the operation.

Sources