A French-speaking cybercrime group allegedly used an AI-enabled attack platform to scan nearly 727,000 internet-facing hosts and collect 16,834 credentials from exposed files and weak configurations This article explores french speaking cybercrime. . The server reportedly contained 4.9 GB of data across 9,299 files, including a custom command-and-control platform, stolen credential vaults, phishing tools, extortion material, and AI-agent configuration files.
Researchers said the platform queued 2,759,860 domains, reached 726,989 hosts, and generated more than 1.37 million IP addresses during the operation. The vault reportedly contained 16,834 entries, including 5,109 generic secrets, 3,448 database credentials, 1,535 SMTP accounts, 936 API keys, 478 AWS keys, 343 GitHub credentials, and 68 Stripe keys.
Instead, it involved confirmed compromises stemming from basic security lapses, such as publicly accessible cloud storage, exposed configuration files, weak signing secrets, and sensitive key material embedded in browser-side code. One campaign impersonated the French bank Société Générale. Instead of using a malicious link or attachment, the phishing email instructed recipients to call a fraudulent phone number about an alleged unauthorized transaction.
This method could bypass many email security filters due to the lack of need for malware delivery or redirecting to a phishing site, according to Socradar.
