Cybercrime threat actors are expanding their use of artificial intelligence assistants to plan, test, and execute a wide range of malicious operations, according to an analysis of an attacker’s operational environment.According to a report by Unit 42, the attacker’s interactions with jailbroken AI tools included receiving step-by-step guidance on setting up a Voice over IP (VoIP) fraud scheme. One assistant even generated a document that included a dedicated section on identifying future exploitation opportunities. The investigation provides unique insights into how threat actors formulate agentic attacks across different campaign types.The findings indicate that the threat actor used basic tools and relied heavily on AI-generated scripts and intelligence collection reports, demonstrating a lack of the technical skills that would have been required to conduct such operations prior to the era of accessible AI.Despite what appeared to be a degree of clumsiness, the attacker caused real damage, targeting a series of entities in India, including academic institutions and online education platforms. The intrusions compromised thousands of records containing personally identifiable information and mapped the attack surfaces of various organizations.Researchers identified that the attacker, operating under the alias BUGSTER, applied AI across several distinct cybercrime categories, including credential theft, data exfiltration, telecommunications VoIP fraud, Wi-Fi password cracking, intelligence gathering on cryptocurrency holders, and command-and-control operations.The investigation revealed that the attacker configured the Hermes Agent framework with the DeepSeek V4 engine as its reasoning core, using the Cursor development environment as a secondary tool, with safety controls disabled in both.An AI-generated brute-force campaign was directed against an Indian university website, alongside a confirmed breach of another university from which a database of more than 5,200 records containing students’ personal identifiable information was stolen.The attacker developed dedicated AI bot profiles to acquire VoIP fraud expertise through conversational prompts and maintained automated pipelines for cracking wireless network passwords and collecting intelligence on large cryptocurrency holders—an activity requiring physical proximity to the target, indicating local access.The combination of Hermes and DeepSeek is being adopted independently by multiple unrelated threat actors, pointing to a common toolchain emerging due to low costs, easy access, and simple safety bypass mechanisms.A technical analysis of a WordPress attack targeting an online education platform demonstrated the use of structured intelligence reports featuring severity ratings and executive summaries typical of AI platforms.The attack progressed in four stages: mapping a dozen subdomains, extracting user IDs via an API while bypassing the Cloudflare WAF, generating a custom tool to attack 117 usernames using 28 common passwords, and ultimately securing a valid system login.
Click Here For The Original Source.
——————————————————–
