GTG-50029 — Hacktivist Campaign Against European Political Entities Ran on Stolen API Keys

Summary

In the spring of 2026 a single French-speaking actor targeted European political parties, media, think tanks and the SaaS providers those organisations rely on. The campaign ran for a month entirely on stolen API keys and used an agentic sub-agent framework for reconnaissance, code review and validation of findings. The vendor disrupted the activity. It is the report's clearest demonstration that AI closes the capability gap turning low-level hacktivists into persistent threats.

Key Facts

• Actor: a single French-speaking individual. Low baseline capability, high motivation.
• Key harvesting: the actor built a custom Rust-based scanner to find and validate exposed API keys in public containers, then rotated key usage across a local proxy layer so that traffic blended in with the legitimate key owner's traffic — no cheap tell-tale for defenders.
• Agentic structure: Claude's agentic coding capability drove a framework managing sub-agents responsible for pre- and post-authentication reconnaissance, code review, and vetting findings produced by different AI models.
• Signature technique: an undocumented WordPress re-installation race condition that created a rogue administrator account without valid credentials. The actor developed and debugged the exploit with AI in the same session, including building a lab harness, and it succeeded against at least four victim websites.
• Data stolen: one political campaign management platform was compromised via an exposed search endpoint; the actor tasked its agents to iterate across that endpoint and exfiltrated approximately 140,000 records including users' political opinions.
• Persistence and harvesting: a webshell hidden among font assets, built on the fly once the upload vulnerability was identified; a WordPress "must-use" plugin that harvested submitted credentials, encrypted them with per-site public keys and staged them for pickup; and poisoned backups, so restoring a clean environment would re-infect the victim.

Significance

No Australian or New Zealand nexus is established by this case — the targets are European political entities — but the technical content is transferable: a previously unknown WordPress race condition exploited against at least four sites, persistence through poisoned backups, and credential harvesting via a must-use plugin. WordPress re-installation paths are present in every jurisdiction's web estate. The more significant shift is qualitative: a sole actor with minimal resources sustained a multi-victim intrusion campaign for a month, funded entirely by someone else's API keys, which is the operational profile that previously required a group.

Sourcing caveat

Single-source vendor disclosure. The activity and tooling were observed on the vendor's platform and disrupted there; no victim or law-enforcement corroboration is cited in the report.

Related: Ai Uplift, Generative Threat Groups, Patch Gap Zero Day Weaponisation