Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks and Auth Bypasses

Hunt.io researchers have detailed a campaign codenamed Operation CameraSwarm that compromised over 14,530 Dahua devices between June 17 and July 22, 2026. Analysis of a 407 MB exposed working directory containing 2,616 files revealed that the attack chain began with credential attacks targeting weak or default passwords on Dahua surveillance devices. Two authentication-bypass flaws were also exploited to circumvent login mechanisms without valid credentials. Additionally, a peer-to-peer (P2P) relay technique was used to facilitate device communication and persistence across networks. The full scope of the campaign, its threat actor attribution, and the precise technical details of the bypass flaws remain unconfirmed. Dahua has not issued specific patch guidance, though security experts advise changing default credentials, disabling P2P management where not required, and monitoring for available firmware updates.