Executive Summary
The KeyHunter Operation, attributed to a Chinese-speaking threat actor known as leepsmarts, represents a highly automated, AI-driven campaign active through late 2026. The operation is characterized by three primary tracks: the systematic theft of Large Language Model (LLM) API credentials, a large-scale academic fraud campaign targeting 20 universities (19 in the U.S.), and a diversified financial fraud pipeline involving cryptocurrency drainers and credit card validation.
The actor utilizes advanced AI agent frameworks, specifically OpenClaw and Hermes Agent, to automate reconnaissance, target selection, and tool development. While the operation successfully harvested thousands of LLM keys and processed leaked Harvard alumni data associated with the 2025 ShinyHunters incident, its exploitation of U.S. university infrastructure via CVE-2026-41940 remained largely in the staging phase at the time of discovery. The breadth of the infrastructure, spanning China, South Korea, Malaysia, and the U.S., underscores the actor's global reach.
For organizations, this threat highlights the critical risk of credential exposure in cloud development environments (Vercel, Netlify, etc.) and the increasing use of AI to lower the barrier for sophisticated phishing and fraud. The targeting of educational institutions for identity theft and service abuse presents significant reputational and financial risks to the academic sector.