Somebody left the front door open on the machine they were running their hacking operation from. CloudSEK's Global Threat Intelligence team found an open directory on a non-standard port of a staging server, serving the operator's entire home folder to anyone who asked. Researcher Ayush Panwar and the team crawled it, cataloguing 21,442 directories and 142,262 files, and mirrored the lot before the host went dark.
What was inside is the interesting part. The operator, described as financially motivated and Chinese-speaking, had not been hacking by hand. He had been running a fleet of AI coding agents as an unattended workforce.
The brakes were deliberately removed
Recovered shell history shows approval prompts globally disabled, sub-agent auto-approval switched on and full-auto execution configured with high concurrency across every agent profile. He also launched agents with the permission-bypass flag. His typed messages, preserved in the agents' own session transcripts, read like a man losing an argument with a safety feature, repeatedly demanding that the agents stop asking him to approve things and restart themselves when confirmations persisted.
The second move was social. Every engagement opened with the same reusable Chinese-language prompt casting the job as an authorized penetration test, with only the target domain swapped. CloudSEK is explicit that this is a jailbreak costume rather than real authorization: no proof of authorization ever appears, and the private instructions tell the agent to grab live sessions, tokens and wallet keys and chain them into full compromise. The agents were bridged to Telegram so the operation could be tasked from a phone, and during setup he leaked his own live bot token into a transcript.
Twelve thousand backdoors, one automated pipeline
The high-volume campaign was an automated WordPress-to-webshell pipeline. The deduplicated evidence file holds 12,048 compromise records across 8,996 unique sites, each carrying a unique attacker-created admin account. Those accounts were created by the attacker rather than stolen, a distinction CloudSEK is careful about, and a separate set of dumps holds 66 genuinely harvested site admin logins. Behind it sat a 3.4 million host reconnaissance corpus. The victim spread is opportunistic rather than targeted, tracking hosting density: the United States accounts for 27.3 percent, Germany 14.6 percent and France 9 percent. Compromised machines also received a disguised Monero miner.
Where the wallet keys actually came from
The second campaign went after crypto exchanges, DeFi protocols and especially trading bots, which hold users' wallet keys. Across roughly 34 confirmed-breach entries the files held live validated API keys and admin tokens, and in at least two cases the operator retrieved real key material himself.
The far larger holding of wallet keys and seed phrases has a different and important provenance. Roughly 326 Solana addresses with private keys and mnemonics, plus 368 victim records carrying a recovered recovery phrase, were not stolen by this operator at all. They came out of a network of phishing clone sites impersonating a legitimate Solana sniping bot, run by an unrelated phishing crew whose own Firebase deployment had no Firestore security rules. He pulled the Firebase config from the clone sites' frontend JavaScript and read every record through the public REST API, unauthenticated. The site running the legitimate unmodified codebase returned 403 and leaked nothing. The people whose wallets sit in that file were phished by someone else and then scraped by him, and those wallets should be treated as fully compromised and swept to fresh keys.
A command channel that cannot be taken down
The operator was also building an EtherHiding-style command-and-control channel that hides instructions on a public blockchain, an approach IntelFusions covered when a crypto-stealing botnet started taking orders from Polygon. The reconstructed activity window runs from 10 to 28 July 2026, the second recent case of an operator handing target selection to agents after the Hermes agent campaign.
Operator infrastructure includes the staging host 80[.]96[.]109[.]64 on port 18080 and a sister host at 103[.]236[.]54[.]207. Four further addresses in the report are victim-owned systems he compromised, not attacker infrastructure. Full detail is in CloudSEK's report. The operation is not sophisticated in any classical sense. It is ordinary criminal work, running at a volume one person could not previously have managed.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.