[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9zeFkSaFDc7C0zECStWc1wrps7r3PpKC6qU-A0iessw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"afda9863-be85-4461-b951-8377cbe21010","1438-fake-fofa-accounts-used-to-harvest-exposed-ai-api-keys","0df9fa97-39f2-4dc2-b5d6-cec84ac78b53","1,438 Fake FOFA Accounts Used to Harvest Exposed AI API Keys","Threat actors systematically exploited misconfigured servers that left OpenAI and DeepSeek API keys publicly exposed, automating the harvesting process at scale through fake FOFA search engine accounts. The root failure was a configuration management problem: developers and organizations failed to secure their API keys, leaving them discoverable by internet-wide scanning tools. This matters because stolen API keys grant unauthorized access to powerful AI services, resulting in financial harm through unexpected billing and potential misuse of AI capabilities for malicious purposes. At scale, this type of credential harvesting represents a low-effort, high-reward attack that is trivially repeatable as long as keys remain exposed.","**Immediate actions:**\n- Audit all deployed environments now to ensure API keys are stored in secrets managers (e.g., HashiCorp Vault, AWS Secrets Manager) and are never hardcoded in code or configuration files.\n- Rotate any API keys that may have been exposed in public repositories, server responses, or misconfigured endpoints immediately.\n\n**Long-term improvements:**\n- Enforce a secrets scanning policy in CI\u002FCD pipelines to automatically block commits containing API keys or credentials before they reach production.\n- Implement least-privilege access controls on API keys, scoping them to specific IP ranges, use cases, and expiry windows to limit blast radius if compromised.\n- Establish usage-based alerting on AI API accounts so that anomalous consumption (e.g., sudden spikes) triggers an automated investigation workflow.\n\n**Detection measures:**\n- Deploy continuous asset discovery and exposure scanning to identify any internet-facing services inadvertently leaking credentials or configuration data.\n- Integrate threat intelligence feeds (such as FOFA, Shodan monitors) into your security operations workflow to proactively detect when your organization's assets appear in attacker reconnaissance results.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","GDPR Article 32",{"GDPR Article 32":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"If the exposed API keys provided access to systems processing personal data, the failure to implement appropriate technical measures to secure those credentials constitutes a breach of the obligation to ensure security appropriate to the risk.","While not phishing in the traditional sense, the mass creation of 1,438 fake FOFA accounts represents a credential and access harvesting operation through deceptive account abuse, paralleling the scaled deception tactics this technique category addresses.","Exposed credentials represent a known remediable flaw; systematic identification and remediation processes would have flagged and corrected these misconfigurations before attackers exploited them.","Victims had no mechanism to detect that their API keys were stolen and being actively abused; a mature incident response capability with anomaly alerting would have identified the unauthorized usage rapidly.","Misconfigured servers leaking API keys represent a technical vulnerability that should be identified and remediated through a formal vulnerability management process aligned with this control.","Servers were misconfigured to expose API keys publicly; enforcing secure baseline configurations would have prevented credentials from being accessible to internet scanners.","API keys function as authentication credentials; proper lifecycle management, scoping, and rotation of these keys is exactly what this control requires and would have limited attacker access.","published","2026-11-10T10:21:49.786762+00:00","2026-11-10T10:21:49.769+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Ffake-fofa-accounts\u002F","hackers-use-1-438-fake-fofa-accounts-to-steal-openai-and-deepseek-api-keys-acros-a74276","Hackers Use 1,438 Fake FOFA Accounts to Steal OpenAI and DeepSeek API Keys Across the Internet",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":58,"name":59,"problem":60},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]