Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P

Cybersecurity researchers at Hunt.io have disclosed details of a campaign that they say compromised more than 14,530 Dahua devices between June 17 and July 22, 2026, using credential attacks, two authentication-bypass flaws, and a peer-to-peer (P2P) relay technique. The activity, codenamed Operation CameraSwarm, was reconstructed from a 407 MB exposed working directory containing 2,616 files

Reported facts: Hunt.io researchers describe Operation CameraSwarm, a campaign that compromised over 14,500 Dahua devices in June–July 2026 using credential attacks, two authentication-bypass vulnerabilities, and a P2P relay mechanism, reconstructed from a large exposed working directory. These weaknesses in widely deployed connected camera infrastructure highlight systemic risks when core components in the hardware/software supply chain are exploitable at scale. RealGround analysis: For organizations that integrate or depend on Dahua or similar IoT/edge devices in AI-enabled surveillance, monitoring, or analytics pipelines, such compromises can undermine the integrity and availability of AI inputs and downstream decisions. Strengthening SBOM-driven dependency visibility, continuous vulnerability monitoring, and vendor risk governance around embedded/edge components is critical to prevent compromised devices from poisoning data, exposing feeds, or becoming pivot points into AI systems.