A French-speaking criminal crew wired a safety-stripped AI agent into a credential harvesting line, then left the entire control room exposed on the open internet. Researchers at SOCRadar found the server: 4.9 GB across 9,299 files, holding the crew's DXSCAN scanning platform, phishing tools, extortion material and a vault of 16,834 credentials. The uncomfortable part is not that AI broke something new. Every door the agent walked through was already unlocked.
Watch Desk analysis
What happened
Per SOCRadar's report, carried by Cyber Security News, the crew tracked as BlackHatSect0r && DXQRTXX ran a Nous Research Hermes agent against a DeepSeek model, steered by a 14 KB identity file named SOUL.md. The operators deleted the agent's refusal memory, switched off its safety settings and set seven background workers to scan, collect and report around the clock.
The machine's appetite is the striking bit. DXSCAN generated roughly 1,200 random addresses every ten seconds, probed ports 80, 443 and 8080, fingerprinted whatever web software answered and checked for more than 200 credential patterns. Over the campaign the crew queued 2,759,860 domains, reached 726,989 hosts and generated 1,374,300 IP addresses.
What it caught was embarrassingly ordinary: exposed .env and Git files, open cloud buckets, default signing keys, secrets pasted into browser code. One exchange left a JWT signing key set to the value "secret", exposing 418 identity records. The vault grew from 16,415 records on 11 August to 16,834 by 18 August, and 82 of 230 harvested SMTP configurations were verified and staged as phishing relays. SOCRadar also links the material to alleged public-sector data theft, extortion claims and bank-impersonation calls aimed at older people.
What to do now
- Audit cloud storage permissions
Public read or write access on buckets was this campaign's front door. - Pull config endpoints off the internet
Remove .env, .git, debug and actuator endpoints from public reach. - Rotate anything possibly exposed
API keys, AWS keys, GitHub tokens and Stripe keys all sat in the vault. - Keep signing keys server-side
Default or guessable values must be replaced immediately. - Hunt the fingerprints
Watch for GHOST strings, SOUL.md, .hermes directories and unexplained ngrok activity. - Brief the phone habit
This crew's phishing urged victims to ring a number rather than click, dodging link scanners, so call-back procedures earn their keep.
Why it matters
The agent contributed no breakthrough exploit, because none was needed. What it contributed was persistence, speed and parallelism: reconnaissance, validation and collection running at once, with no tired operator at the keyboard. Routine misconfiguration, the kind security teams have nagged about for two decades, becomes materially more expensive when a machine sweeps it up at 1,200 addresses every ten seconds.
The vault's contents explain the blast radius. Cloud keys, GitHub tokens, Stripe keys and working mail credentials are not trophies; they are the raw material for the next campaign.
Our read
Read this as an accelerant story, not a new weapon. The fundamentals remain gloriously boring: close the buckets, delete the config files, rotate the secrets. What has changed is the cost of leaving them open, because the scanning side no longer scales with criminal headcount. A Hermes agent paired with a DeepSeek model, safety rails removed and instructions shrunk to a 14 KB personality file, shows how little friction is left. Do the dull things today; they are now the expensive things to skip.
What to watch
- The full SOCRadar report
Whether the firm publishes complete indicators and other researchers corroborate the attribution. - Responses upstream
Whether Nous Research or DeepSeek comment on criminal repurposing of their tooling. - Copycat configurations
Whether SOUL.md-style stripped agent setups surface in other exposed operations. - Enforcement
Whether any law enforcement action follows the identification.
Discussion spark: The agent invented nothing; it simply never got tired. Does AI-driven scanning change how you prioritise secrets hygiene and exposed endpoints, or is this the same old misconfiguration problem with a louder engine?
Sources and evidence
- BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials – CyberSecurityNews (17 September 2026, 10:56 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.