Hello, thank you for the reply :) I believe they used both methods to collect the API keys. In the article I said: "It's also possible they got the API keys from some already plugged bot."