hxxps://api.deepseek[.]com/v1.LocalURL
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 3 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Inside a Global AI-Assisted Hacking Campaign“…s://xcai.pro/v1.Codex (.codex/config.toml)deepseek-v4-proAlternative coding-agent interface configured to send requests to hxxps://api.deepseek[.]com/v1.Local account named gemini, running Claude Codedeepseek-v4.1-flashWorkspace using shared instructions and specialist agents.Local…”
Indicators reported together
named in the same reports- 38.244.50[.]120in 1 report
- xcai[.]proin 1 report
- sectors[.]inin 1 report
- campaign[.]workin 1 report
- server[.]toolsin 1 report
- version[.]aiin 1 report
- hxxps://xcai[.]pro/v1Herein 1 report
- hxxps://xcai[.]pro/v1.Codexin 1 report
- attacks[.]inin 1 report
- retrieval[.]targetin 1 report
- free[.]legalin 1 report
- privileges[.]toin 1 report
- motivated[.]toin 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.