Hunt.io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets.

Threat intelligence firm Hunt.io just documented a second, separate China-linked campaign wiring commercial AI models directly into live cyberespionage operations, this time hitting Taiwan’s Kuomintang Party archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Vietnam.

The full report traces the operation through five exposed open directories the operators accidentally left publicly accessible, which is how researchers reconstructed the entire orchestration system from the inside.

“Five open directories, one campaign. The exposed directories map to an AI orchestration host, a Java/CAS exploitation workspace, a fake MySQL deserialization service, a Shellshock and credential-testing node, and a payload-distribution store.” reads the report. “SecFlow split reconnaissance, exploitation, collection, and reporting among specialist workers. The runtime could switch between Claude, Qwen, and DeepSeek profiles without changing the task interface.”

The framework behind the campaign, called SecFlow by the operators, could use different AI models, including Claude, Qwen, and DeepSeek. The operators could switch between them without changing how the system worked. Instead of using the models’ official APIs, SecFlow routed requests through private proxy servers linked to the niestools.com domain.

The AI models did not break into systems on their own. They helped automate and organize traditional hacking tasks, such as scanning for vulnerabilities, testing stolen credentials, trying exploits, deploying webshells, collecting data and evidence, and generating reports. The attackers built the infrastructure that connected these AI capabilities to real-world intrusions.

The most damaging confirmed breach hit a Fengtai District government Office Automation environment in China, and it ran the full playbook from web shell to data theft.

“The most extensive compromise hit a Fengtai District government environment, where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.” Hunt.io states. “SecFlow coordinated reconnaissance, exploitation, and reporting across Claude, Qwen, and DeepSeek workers. “

Operators achieved Windows command execution through internet-facing web applications, then used ASPX web shells not just to run commands but as a persistent operational backbone: querying internal databases, pulling an LSASS memory dump apart in 37 separate chunks to avoid detection, and extracting SAM and SYSTEM registry hives containing password hash material.

“The operator divided the LSASS dump into 37 blocks, requested each block through an authenticated SOCKS route, verified the expected byte count, and reconstructed the complete file.” continues the report. “The operator also collected the SAM and SYSTEM registry hives. Another server-side page, extract.aspx, scanned sections of the memory dump for Windows password-hash material.”

From there they pulled 822 OA user account records, created a new privileged account of their own for backup access, and walked away with 949 attachments totaling 1.28GB, including a chronic-disease report containing real patient health information.

In a separate case, the operators also exposed the management backend of a Chinese education AI platform. The irony is hard to miss: an AI company was compromised partly because its own AI infrastructure was not properly secured.

Hunt.io found a backend that anyone could access without authentication. It exposed 23 AI agent configurations, 14 API secret fields containing credentials, and 104 complete chatbot conversations. Some of those logs included real student data, such as names, student ID numbers, majors and academic advisers, taken from career-guidance and study-partner chats.

The exposed credentials were not just old or unused secrets. They worked against the platform’s live production API, meaning attackers could use the stolen keys to access real systems.

One particularly clever access method used a fake MySQL server as bait rather than a target. A malicious service impersonating a MySQL database would accept connections from vulnerable Java applications, then return specially crafted data designed to trigger unsafe object deserialization on the client side the moment it connected, turning what should have been an outbound database query into inbound code execution. That’s initial access flipped on its head, exploiting the assumption that connecting out to a database is inherently safer than accepting connections in.

The webshell tooling itself, a custom framework the operators called GLUTTON, hid its payloads inside PNG image files using steganography, literally embedding executable code in the red, green, and blue color channel data of ordinary-looking images. A small decoder script on the server would read the image pixel by pixel, XOR-decrypt the hidden bytes using a fixed key, and load the resulting code directly into memory without ever writing an obviously malicious file to disk. Any security control that only checks file extensions or content types for image uploads would sail right past this without noticing anything wrong.

This isn’t an isolated incident for the underlying pattern either. It’s the second campaign in two months where researchers caught commercial AI coding tools embedded as operational components of live nation-state intrusions, following a similar Hunt.io discovery in June involving the same Claude Code and DeepSeek combination against separate government and financial targets in Afghanistan and Thailand. Anthropic itself disclosed a related pattern back in November 2025, describing attackers who convinced Claude it was doing legitimate defensive penetration testing by splitting malicious requests into small, individually harmless-looking pieces.

The operators also left a clear trace across their own infrastructure. The username “Nie” appeared several times in hardcoded file paths inside the GLUTTON tools and was reused in proxy credentials, linking all five compromised workspaces to the same campaign.

For defenders, this is especially important if they use Java frameworks vulnerable to deserialization attacks, older Apache or Grafana systems, or public-facing office automation software. The campaign shows that attackers can treat commercial AI models as interchangeable tools. The key question is no longer which AI model carried out an attack, but how quickly defenders can recognize the attack pattern, regardless of which model was used.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

China-linked hackers reportedly used eight AI agents to breach a government network, steal data and compromise accounts with minimal human oversight.

Israeli cybersecurity firm Dream documented what looks like the first fully autonomous, end-to-end AI hacking operation against a government target. Over four days at the start of July, according to the Financial Times, suspected Chinese hackers ran a tool built entirely from publicly available AI agents that mapped 21 government systems, hunted for vulnerabilities, and switched tactics on its own whenever it hit a wall.

“Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” reported the Financial Times.

The tool wasn’t a single script running one attack. It deployed up to eight autonomous agents simultaneously, each working a different angle, more like a coordinated hacking team than a piece of malware. By the time researchers found it, the operation had compromised at least 85 government accounts, pulled over 2,500 personnel records, and expanded to hit a nuclear safety agency and at least seven energy companies.

Dream’s chief strategy officer, Amir Becker, spent years running cyber operations for Israel’s Unit 8200 before this, and he’s not easily rattled by new attack tooling. He said flatly he’d never seen anything like this level of autonomy directed at a government before. “This must be the basic assumption of every government around the globe,” Becker said.

He argued that permanent, assumed compromise is now the only realistic starting posture.

Dream won’t officially name the target government, citing company policy, though a person familiar with the matter told the FT it was Taiwan. The clues inside the data point the same direction: internal communications tied to the hacking tool were written in Simplified Chinese, while the data actually stolen from the target came back in Traditional Chinese, the script used almost exclusively by government systems in Taiwan, Hong Kong, and Macau. Taiwan’s Ministry of Digital Affairs declined to confirm anything specific, saying only that incidents involving government agencies follow established response procedures.

What makes this different from an AI model going rogue during a lab test, something Anthropic, OpenAI, and Meta have all separately reported in recent weeks, is that this wasn’t an accident inside a sandbox. Researchers found the toolkit sitting in a 160MB archive, 1,395 files built around two open-source AI agent frameworks, Hermes and OpenClaw, both freely downloadable and designed to let AI models act autonomously on real tasks. Whoever built this deliberately assembled it as a weapon.

Getting the underlying AI model to cooperate took a specific trick rather than brute force. The operators had bypassed the model’s safety guardrails simply by framing the entire hacking campaign as an authorized penetration test, a scenario the model apparently had no reliable way to verify or reject. That’s a strange kind of vulnerability: not a flaw in the code, but a flaw in how convincingly you can lie to a system that’s trying to be helpful.

The part Dream’s researchers found most striking wasn’t the scale, it was the decision-making. The tool kept ranking and reprioritizing possible attack paths as new evidence came in, and when one route hit a dead end, it spun up another agent to search the internet for fresh information and try a different approach, the same iterative process a human red-teamer would run, just without anyone sleeping.

“The most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said.” reported the FT. “When one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would.”

Taiwan’s National Security Bureau already logged an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% year over year; if a meaningful fraction of that volume starts running with this kind of autonomy, the math on defending against it gets a lot uglier very quickly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

Note The June 2026 Dark Web Breach Incident Trend Report is based on major data breach cases posted on the deep web and dark web forums. Due to the nature of some sources, it was difficult to fully verify the accuracy of certain information, so the report includes content that requires further verification. Major Issue […]

Notes the May 2026 Dark Web Breach Incident Trend Report is organized around the major cases of Data Breaches posted on the deep web and dark web forums. due to the nature of the source, some of the information may not be fully verifiable as to whether it is true or not, and is therefore […]

A 23-year-old radio enthusiast spent £300 on a piece of kit from the internet, and used it to bring four packed high-speed trains to a screeching halt. His defence in court? Possibly the most creative excuse we've heard all year. Meanwhile, owners of $4,000 robot lawnmowers are discovering that their gadget can be hijacked over the internet, redirected at journalists who foolishly lie down in front of it, and used to harvest Wi-Fi passwords, email addresses, and GPS coordinates. Change the default password? Sure - until the next firmware update silently resets it back. Plus - don't miss our featured interview with XBOW's Brendan Dolan-Gavitt about how AI is transforming penetration testing. All this and more in episode 468 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Geoff White.