KeyHunter Operation: Harvard Alumni Data, Stanford Applications and LLM Key Theft

The KeyHunter operation is a multi-vector cyber campaign by the Chinese-speaking threat actor leepsmarts targeting academic institutions and cloud infrastructure. It involves theft of large numbers of LLM API keys from misconfigured cloud platforms, creation of fraudulent student accounts at multiple universities, and processing of stolen Harvard alumni data. The operation uses AI agent frameworks and Telegram bots for automation. Parallel financial fraud includes cryptocurrency draining and credit card validation using stolen credentials. The infrastructure spans multiple countries and has been active since early 2026.

• WebPros cPanel & WHM and WP2 (WordPress Squared) · cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5CriticalVulnerability2026-04-29
• cPanel en WHM · Kwetsbaarheid VerholpenExploitedVulnerability2026-04-30
• CVE-2026-41940: WebPros cPanel · Missing AuthenticationCriticalVulnerability2026-04-29
• The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesMalware2026-11-02
• GitBait: Phishing targeting the Mexican financial sectorPhishing2026-06-18