Hackers Use 1,438 Fake FOFA Accounts to Steal OpenAI and DeepSeek API Keys Across the Internet

Threat actors systematically exploited misconfigured servers that left OpenAI and DeepSeek API keys publicly exposed, automating the harvesting process at scale through fake FOFA search engine accounts. The root failure was a configuration management problem: developers and organizations failed to secure their API keys, leaving them discoverable by internet-wide scanning tools. This matters because stolen API keys grant unauthorized access to powerful AI services, resulting in financial harm through unexpected billing and potential misuse of AI capabilities for malicious purposes. At scale, this type of credential harvesting represents a low-effort, high-reward attack that is trivially repeatable as long as keys remain exposed.