Stolen Gemini API Keys Enable Telegram Influence Campaign

Reporting by GBHackers Security, indexed by ITSecurityNews, describes a long-running Telegram influence and fraud campaign tracked as "bandcampro." The report states a solo Russian-speaking operator leveraged stolen Google Gemini API keys and jailbroken AI to automate content generation, credential theft, and infrastructure operations. Per the report, the actor maintained a MAGA-themed Telegram channel, @americanpatriotus, for nearly five years and amassed around 17,000 subscribers.

Editorial analysis - technical context: Public reporting identifies two technical enablers: leaked or stolen cloud AI credentials and the use of jailbroken models or prompts to remove safety constraints. In comparable incidents, threat actors chain an automated pipeline that:

• •submits prompts to an API to generate tailored propaganda or phishing text
• •automates delivery via messaging platforms like Telegram
• •harvests credentials or wallet data through follow-up social engineering. Abuse of cloud API keys can also create stealthy, billable compute usage that is hard to trace if credentials are unmonitored

This case fits a broader pattern where commodity generative AI lowers the marginal cost of producing scaleable disinformation and fraud content. Observers have previously documented threat actors combining platform automation, scraped audience lists, and AI-generated messaging to increase reach and personalization. For defenders and practitioners, the combination of leaked API keys and jailbreak techniques raises both detection and attribution challenges because content can be produced programmatically and routed through standard platform APIs.

For practitioners and incident responders: monitor unexpected billing or API usage on AI service accounts, look for automated posting patterns from new or long-dormant channels, and instrument API key rotation and least-privilege controls. Observers should also track law enforcement announcements or platform takedowns related to channels such as @americanpatriotus and broader disclosure of compromised AI credentials. GBHackers Security provides the primary reporting on this specific campaign; the operator has not been quoted in the coverage.