Hackers Turn Claude, Qwen and DeepSeek Into AI Agents for Real-World Cyberattacks
Brief
Hackers have turned commercial AI models into working parts of a cyberattack operation. The campaign paired AI-directed tasking with familiar methods such as vulnerable public-facing servers, stolen credentials, webshells, and custom remote-access malware.
The operation reached Taiwan’s Kuomintang Party History Archives, Indonesia’s Ministry of Foreign Affairs, and government and education networks in mainland China.
A confirmed breach hit a Fengtai District government environment, exposing administrative and health records, collecting Windows credentials, and deploying implants.
Analysts at Hunt.io identified the activity after examining exposed attacker directories and tracing a shared SOCKS proxy across five connected workspaces.