A French-speaking cybercrime group allegedly used an AI-enabled attack platform to scan nearly 727,000 internet-facing hosts and collect 16,834 credentials from exposed files and weak configurations.
Security researchers discovered an exposed operation server linked to the group known as BlackHatSect0r && DXQRTXX.
The server reportedly contained 4.9 GB of data across 9,299 files, including a custom command-and-control platform, stolen credential vaults, phishing tools, extortion material, and AI-agent configuration files.
The group’s main platform, called DXSCAN, was written in Go and operated as a large-scale scanning system.
Researchers said the platform queued 2,759,860 domains, reached 726,989 hosts, and generated more than 1.37 million IP addresses during the operation.
AI Hacker Harvests 16,834 Credentials
The scanner checked systems on common web ports, including 80, 443, and 8080. It looked for exposed .env files, cloud keys, database credentials, SMTP accounts, API tokens, Git files, and application configuration data.
The credential vault reportedly contained 16,834 entries. These included 5,109 generic secrets, 3,448 database credentials, 1,535 SMTP accounts, 936 API keys, 478 AWS keys, 343 GitHub credentials, and 68 Stripe keys. Researchers also found that some SMTP accounts were tested and prepared for possible use in phishing activity.
The operation did not rely mainly on unknown vulnerabilities or advanced zero-days. Instead, its confirmed compromises came from basic security failures, such as publicly accessible cloud storage, exposed configuration files, weak signing secrets, and sensitive key material embedded in browser-side code.
The AI component reportedly used a Hermes agent connected to a DeepSeek model. The attackers modified the agent’s memory and identity files to remove refusal behavior and disabled safety controls through the HERMES_DISABLE_SAFETY=1 setting. Seven worker processes were then configured to keep scanning and collecting data with limited operator involvement.
The exposed server also included tools for several criminal activities beyond mass credential harvesting.
These included ransomware-style extortion portals, cloud-storage targeting, phishing kits, cryptocurrency-related scripts, and tools for abusing stolen personal data.
One campaign impersonated French bank Société Générale. Instead of using a malicious link or attachment, the phishing email told recipients to call a fraudulent phone number about an alleged unauthorized transaction.
This approach could bypass many email security filters because the message did not need to deliver malware or redirect victims to a phishing website, socradar said.
Researchers also found evidence that the group held a French telecom subscriber dataset containing nearly 450,000 records. The data reportedly included names, addresses, phone numbers, dates of birth, subscriber details, and banking information.
A subset of phone numbers associated with people aged 50 and above was allegedly selected for targeted telephone fraud.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
