Observed incident

KeyHunter records show AI agents coordinating credential collection and account fraud

Reported

Published here

What happened

SOCRadar recovered operator logs and bot history describing LLM key collection and fraudulent academic accounts. The operator counted 2,233 keys, marked 12 valid and catalogued 247 model gateways. Researchers linked Hermes Agent and OpenClaw to the operation.

Parties and reporting

AI tools and systems: Hermes Agent, OpenClaw, KeyHunter scanners, LLM provider keys and gateways

Outcome

Records describe created university accounts, application links and processed alumni data from a circulating dataset. A staged exploit against university systems had no confirmed successful outcome. Final financial losses and containment are unknown.

Operating lesson

Rotate exposed model keys, inspect inference charges and public deployment files, and independently verify claims made in account or payment applications.

Evidence and limits

The key tally and validity labels come from the operator’s tools. The 20 targeted institutions had different outcomes. SOCRadar did not establish a fresh intrusion into Harvard from the reused alumni data. It attributes the infrastructure to one operator with high confidence, without establishing their physical location.

Sources