11.11.2025
3 min
758
Cybersecurity researchers discovered an unsecured server containing source code, databases, and the results of several fraudulent operations. The attacker’s primary targets were gift cards, which they attempted to intercept on trading platforms before transactions between users were completed.
Cybersecurity researchers discovered the unsecured infrastructure on July 19, 2026. The server contained source code, notes on attacks, databases, and records of illegal activities. According to the researchers, the fraud scheme had been operating since at least March 2026.
The attacker focused on P2P platforms where users buy, sell, or exchange gift cards. The goal was to obtain data from newly uploaded gift cards before buyers and sellers completed their transactions.
Such cards are particularly attractive to fraudsters because they essentially function as digital cash. They can be quickly redeemed or resold, and recovering stolen funds after redemption is usually difficult.
Based on the discovered materials, the preparation for the attacks was extensive. The hacker investigated 58 gift card trading platforms and three additional P2P cryptocurrency exchanges that accepted gift cards as a payment method.
Not all services proved suitable for attacks. However, on some platforms, the attacker discovered exposed internal data, links to gift cards, or technical information that could be used for further exploitation.
The main tools were ten Python scripts, each designed for a specific trading platform. They monitored newly uploaded gift cards, often within the first 90 seconds of their appearance.
The specific vulnerabilities varied from one service to another. The attacker primarily targeted misconfigured cloud storage systems accessible to unauthorized users, as well as configuration flaws that allowed authentication bypasses or access to gift card information.
The server contained SQLite databases, image hashes, event logs, and links to intercepted images from ten trading platforms. This suggests an attempt to automate data collection and turn it into a steady source of income.
Among the platforms investigated, Cardlumi stood out in particular. Researchers found 4,098 order records, 3,690 image hashes, and 3,998 intercepted gift card images associated with the service on the server. These figures suggest that Cardlumi may have been one of the attacker’s primary targets.
Researchers identified another issue in materials related to the Cardtonic platform. According to the records, an API misconfiguration allowed any authenticated user to request information about other users’ transactions.
The exposed data potentially included gift card codes in plaintext and users’ email addresses. However, the researchers emphasized that they found only evidence of a proof-of-concept (PoC) exploit in this case. No large database of stolen Cardtonic codes or personal information was discovered on the server.
The discovered materials revealed that gift card fraud was not the server owner’s only activity.
A separate operation targeted Trustonic ALPS, a cloud platform used by mobile operators to remotely lock and unlock devices, including in cases of loss or theft.
According to the researchers, the attacker combined compromised credentials with an API misconfiguration. This potentially allowed users with read-only access to modify smartphone locking and unlocking policies.
The server contained credentials belonging to Trustonic employees and client organizations, information about vulnerabilities, and materials demonstrating how they could be exploited.
However, the researchers found no evidence of widespread exploitation of this issue. Trustonic conducted its own investigation and stated that the discovered credentials had not been stolen through a breach of its Trustonic Telecom Platform.
“The investigation found that the credentials had been compromised as a result of malware infections on affected customers’ devices. Specifically, a type of infostealer stole login credentials directly from users’ browsers during authentication,” Trustonic explained.
After discovering the issue, the company contacted all affected users and recommended that they immediately scan their devices for malware and remove any infections. Trustonic also reset the passwords of compromised accounts to prevent further unauthorized access.
The third scheme uncovered was linked to Octoplus Box, a tool used for mobile phone servicing and software maintenance.
According to the materials found on the server, the attacker created a fake GSM service that imitated the Dhru Fusion API. To do so, they used ten compromised Octoplus Box accounts. The access obtained was then used to sell services through a Telegram bot at inflated prices.
Researchers found an SQLite database containing information about compromised reseller accounts, including their usernames and plaintext passwords.
The same database also contained 341 transaction records linked to the scheme. This suggests that the owner of the unsecured server was likely running several illicit money-making operations simultaneously rather than conducting a single fraud campaign.
Another detail of the investigation concerns the use of artificial intelligence. The discovered files contained indications that the attacker had automated some of their activities using Anthropic’s Claude AI. According to the research report, Claude was used as the primary AI agent in the attack workflow. However, the available evidence does not establish exactly which tasks the model performed or how significant its role was in the fraudulent operations.
The server also contained references to personal email addresses that may belong to the infrastructure’s owner. Some of the reports were written in Spanish, leading researchers to suggest that the operator may have been a Spanish speaker. However, they were unable to identify the individual based on this information.
The researchers published a timeline detailing the discovery of the unsecured infrastructure and the notification of companies whose services were mentioned in the recovered materials.
The server was discovered on July 19, 2026. By August 14, public access to it had already been restricted. Initial notifications were sent to Cardtonic and Trustonic on August 28, while Cardlumi representatives were informed on August 31.
The researchers also contacted the affected organizations for comment. At the time of publication, not all companies had responded.
The exposed server allowed researchers to reconstruct several interconnected fraud schemes, including the automated interception of gift cards, the use of stolen credentials, and the resale of services through Telegram. However, not all identified attack methods were confirmed to have been exploited on a large scale.
