Exposed hacker server reveals QuickLaunch attacks on universities

Cybernews researchers discovered an exposed hacker server that revealed attempts to access university login systems and reach student and teacher data. The team said attackers exploited known QuickLaunch vulnerabilities to create user accounts and steal private information. QuickLaunch is an AI-powered tool that helps colleges and universities manage how students and staff sign in to school systems and access online services. At least 42 universities were identified as potential targets, while 40 more were listed as using another type of sign-on setup.

What the server contained

The exposed server held more than attack notes. Researchers found 373 Python scripts believed to have supported the operation and 43 Markdown files outlining attack paths and reporting results. Some reports were written in Mandarin Chinese and styled like legitimate red-team assessments, suggesting the operator may have been Chinese-speaking. Researchers said that alone cannot confirm the attacker was based in China.

The server also contained JSON, CSV and text files with interim and final results, plus two environment files exposing a DeepSeek API key, indicating that some workflow parts may have been automated with Chinese-made AI assistance. A public SSH key likely tied to the attacker was also left behind. The server stored roughly 32,400 unique user records across 1,079 domains, with names, email addresses and user IDs.

How the login attack worked

Records on the server indicated the attacker chained weaknesses in QuickLaunch and the underlying WSO2 identity software. CVE-2024-7097 allowed unauthorized user accounts through the QuickLaunch API, giving a foothold. CVE-2025-5605 exposed internal system information, including memory statistics, which could help map the target system.

The records also pointed to a QuickLaunch-specific password-reset weakness that let attackers take over at least one real university account if security questions had never been enrolled. The attacker also appeared to exploit an undocumented issue in WSO2 WS-Federation Passive STS service to obtain a valid login token even with the wrong password. That token was used as proof of authentication to access internal user data and, in at least one case, mailbox contents.

The attackers also targeted 40 universities using self-hosted ADFS, another campus login system. Records showed 36 instances of exposed federation metadata, including endpoints and certificates. That did not prove a breach by itself, but it gave attackers useful intelligence to map systems and plan follow-on attacks.

Risks and timeline

The researchers said affected education institutions face risks beyond account compromise. Universities handle large amounts of personal and financial data of students and staff, which can be used for identity theft, financial fraud and social engineering. They often also hold sensitive, unpublished research and intellectual property.

Cybernews said it reached out to QuickLaunch for a statement. The disclosure timeline listed the exposed threat actor server as discovered on July 17, 2026, initial disclosure to QuickLaunch on August 5, 2026, and the threat actor server observed closed on September 2, 2026. As of September 2, the threat actors appeared to have closed the server.

Sources: Cybernews