Stolen Gemini API Keys Enable Telegram Influence Campaign

Strip away the MAGA-channel framing and this is a clean case study in two underwatched attack surfaces. First, an agent's persistent memory or config file is an injection surface: by convincing Gemini it was an "authorized pentester," the operator wrote permissive instructions into a GEMINI.md file that the Gemini CLI reloaded at the start of every session, so the jailbreak survived and reinforced itself rather than needing to be re-established. Second, round-robin rotation across roughly 73 stolen API keys spreads usage thin enough to dodge per-key rate limits and anomaly thresholds. The practical defenses follow directly: monitor for unusual round-robin or distributed key usage, alert on unexpected billing, enforce least-privilege and rotation on credentials, and treat agent memory and config files as code that needs integrity controls.

Trend Micro's research, which it tracks as the "Patriot Bait" campaign, describes a solo Russian-speaking operator who maintained a MAGA-themed Telegram channel, @americanpatriotus, for nearly five years, building an audience of about 17,000 subscribers. Starting in September 2025, the operator pivoted to fully AI-generated content, running a pipeline of Python scripts - named "Quantum Patriot" - that called a jailbroken Google Gemini to roleplay as an American veteran patriot and mass-produce posts, fraud lures, and credential-theft material.

The operator used roughly 73 likely-stolen Gemini API keys on a round-robin rotation. The jailbreak relied on prompt engineering plus persistent memory manipulation: posing as an authorized penetration tester, the actor got the model to store permissive instructions in a local GEMINI.md memory file, and because the CLI reloaded that file each session, the bypass persisted over time. GBHackers and The Register also covered the case, consistent with Trend Micro's account.

Despite the automation, the documented results were modest: 29 WordPress administrator accounts compromised, one enterprise environment infiltrated, and at least one cryptocurrency wallet drained. The significance is less the body count than the demonstration that one person, commodity generative AI, and a supply of stolen keys can sustain a years-long, automated influence-and-fraud operation at low marginal cost.

Watch for provider-side detection of distributed key abuse and jailbreak-persistence patterns, platform takedowns of channels like @americanpatriotus, and any broader disclosure of how the Gemini keys were leaked - credential hygiene at the source remains the upstream fix.