Loading threat actor…
Zerofot is a financially motivated credential-harvesting operation associated with a Chinese-speaking operator. It opportunistically targets internet-exposed sensitive files and open directories to obtain credentials for cloud environments, servers, AI providers, and SaaS platforms. Stolen AI-provider credentials have been used to supply a gateway reselling access to AI models. The operator's country of origin and any state affiliation are not established. Its principal tool, auto_scan, was developed using OpenAI Codex and Claude Code. The scanner processes targets obtained through FOFA and masscan, downloads accessible files and directory listings, extracts candidate credentials, and validates them against the corresponding services. Between April 5 and May 23, 2026, the operation collected 2,975 validated keys and credentials from 1,742 victim hosts. These included SSH private keys, AWS access keys, and credentials for Google Gemini, OpenAI, GitHub, Anthropic, Stripe, and other services. The AWS credentials encompassed 214 accounts. Zerofot's activity extends beyond collection into cloud reconnaissance and post-exploitation. Sliver command-and-control implants have been deployed on compromised hosts. The operator also framed tool-development requests as authorized capture-the-flag exercises to circumvent AI model refusals.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
18 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.