Unit 42 uncovered an AI-driven Chinese hacking campaign where DeepSeek autonomously scanned targets, selected exploits, and launched attacks.

Researchers at Palo Alto’s Unit 42 got a front-row seat to something they’d only theorized about before: an AI system running an actual hacking campaign with almost no human steering it. The researchers spotted a Chinese-speaking actor, going by the handles knaithe and KnYuan, who wired DeepSeek into an open-source framework called Hermes Agent and let it hunt for vulnerable targets, find exploit code, and launch attacks on its own.

The researchers only saw any of this because the attacker made one careless mistake.

That mistake was starting a file server in the operation’s home directory instead of an isolated staging folder. It exposed everything: API keys, exploit scripts, target lists, bash history, and full session logs of the AI actually doing the work.

Unit 42 essentially got to watch the attacker’s screen after the fact.

DeepSeek wasn’t the only AI in play. The actor also tested Qwen, GLM, Kimi, and MiniMax, and even poked at two Western tools, Claude Code and Codex, though only in a limited, exploratory way. Claude Code got ten total interactions across three sessions, mostly connectivity checks; Codex’s actual use couldn’t be confirmed because the attacker had disabled its conversation logging.

“In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax). We also identified limited usage and testing of Western platforms. This includes Claude Code for connectivity testing and proxy validation.” reads the report published by Unit 42. “There were also signs of usage of Codex on exploit development directories. This limited usage is consistent with evaluating the AI-market to identify their preferred tool set.”

The tool configuration says a lot about intent. Both Western tools got routed through a third-party proxy to hide the connection, with attribution headers stripped and non-essential traffic disabled. DeepSeek and Qwen, by contrast, connected straight to their native APIs with no such precautions, which tells you which tool the attacker actually trusted for the job.

“DeepSeek, operating through the Hermes Agent framework, served as the actor’s primary offensive AI tool. Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making.” continues the report.

“The actor had customized Hermes Agent with three red-teaming skills:

• fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor’s fofoapi.py script for internet asset enumeration”
• godmode: LLM jailbreaking, framework-bundled
• web-terminal-exploitation: unauthenticated WebSocket exploitation, custom-created”

Watching DeepSeek work through an actual attack chain is the most striking part of the report. It found a Langflow vulnerability (CVE-2026-33017), downloaded a public proof-of-concept, scanned for 84 live instances, and hit a wall: every target needed either a public flow ID or a login setting the attacker didn’t have access to. Rather than giving up, DeepSeek talked itself through the dead end and moved on, reasoning in real time that the deployment base was too small to bother with and it should look for something bigger.

That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had. FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China. DeepSeek chained two separate vulnerabilities together, worked out exactly which version range was exploitable, then ran headfirst into the same kind of wall as before, every accessible form endpoint it found required authentication it didn’t have.

The AI never fully broke in anywhere during these autonomous runs. But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes. “the system executed hundreds of hours of manual targeting analysis in mere minutes”, and that’s the number that should worry defenders more than any single failed exploit.

“While most of the systems were unreachable or non-responsive, DeepSeek found three with the vulnerable versions and attempted to exploit them automatically. This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.” continues the report. “Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987). “

While the AI chased those two failures, the same actor was busy elsewhere doing old-fashioned manual hacking that actually worked. They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. One target, a government body in Malaysia, got hit repeatedly over multiple days with increasingly careful technique and proxy anonymization layered in on later attempts, a level of patience the fully-automated runs never showed.

Unit 42 traces the actor back to Zhuhai, China, partly through a side project on GitHub: an automated tool that scrapes seventeen sources for newly disclosed remote-code-execution bugs, uses DeepSeek to sort which ones are actually exploitable, and pushes alerts out over Telegram. That’s a hacker who’s already comfortable outsourcing judgment calls to a language model well before this campaign started.

Nothing here fully succeeded, and that’s exactly the point researchers are making. The only thing standing between working exploits and failed ones was target-side configuration that happened to be tighter than average, not any weakness in the attacker’s approach. Build your systems with the defaults this campaign got blocked by, because the AI running the offense clearly isn’t going to be the bottleneck for much longer.

“Our findings document a threat actor developing AI-augmented offensive capabilities that enabled them to dramatically increase the speed and scale of their campaigns.” concludes the report. “This research validates an emerging threat posed by AI-enabled attackers as they hone their autonomous attack processes to discover, assess, pivot and retarget without human intervention.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

Unit 42 details a Chinese speaking threat actor combining autonomous AI scanning across seven vulnerabilities with manual exploitation. Read more.

The post Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks appeared first on Unit 42.

Chinese actors used Claude Code and DeepSeek to automate attacks that breached government systems and targeted financial firms.

Hunt.io researchers stumbled onto an active intrusion campaign in June 2026 while pivoting on known TencShell command-and-control infrastructure. A single HTTP header fingerprint on port 1111 led them to 13 Hong Kong-based servers and, on one of them, an open directory containing 2,431 files and 80 subdirectories: victim source code, custom exploit scripts, cloned login pages, and operator logs with notes written in Simplified Chinese. Someone left the door open. Researchers walked right in.

What made this find unusual wasn’t just the scope of the targeting. It was the tooling.

“What caught our attention was the tooling behind it. Claude Code and DeepSeek-v4-pro ran as working parts of the intrusion, not tools off to the side. They handled reasoning for bypass techniques, reworked exploits after failed attempts, and built the phishing pages used to harvest credentials.” reads the report published by Hunt.io. “That puts this campaign alongside Anthropic’s November 2025 disclosure of a China-linked operation that used Claude Code to automate large-scale intrusions.”

This puts the campaign alongside Anthropic’s own November 2025 disclosure of a China-linked operation that used Claude Code to automate large-scale intrusions.

The campaign resembles another China-linked operation that Anthropic disclosed in November 2025, where attackers also used Claude Code to automate large-scale intrusions.

The recovered logs show that the attackers split the work between two AI models. Claude Code 2.1.165 handled execution by running Bash commands, managing long-running sessions, carrying out tasks in parallel, and creating phishing infrastructure. DeepSeek-v4-pro handled the planning by generating scripts, choosing attack techniques, and finding new ways to bypass defenses when earlier attempts failed.

“DeepSeek-v4-pro operates as the underlying reasoning model, handling attack logic, script generation, and decision-making.” continues the report. “In short, offensive logic is routed through a Chinese domestic LLM while leveraging Anthropic’s agentic execution infrastructure.”

A recovered CLAUDE.md file also contained instructions telling Claude Code to automatically create, test, and improve cloned phishing pages for multiple targets.

Session IDs in the logs confirmed the same infrastructure was used across different country-specific campaigns, with Taiwan operations saved to dedicated working directories. Timestamps on the files span June 8 through 12, 2026, and the three servers sharing SSH keys were actively maintained as recently as June 18-19, when all three reissued their ARL certificates together.

In Thailand, attackers used SQLMap to exploit a government administrative system through SQL injection, gained admin panel access, and deployed a web shell disguised as a GIF file for persistent command execution. The exfiltrated database held the names, national ID numbers, and job titles of government employees. The directory contained 980 files referencing this system alone, suggesting a lengthy and focused operation. Test entries the attackers created during the intrusion confirmed they had hands-on, interactive access to the data, not just automated extraction.

In Afghanistan, a government web application handling citizen complaint submissions was compromised. The attackers extracted source code, database credentials, encryption keys, and mail infrastructure code from a Laravel 5.8.38 installation, then used those credentials to build a custom Python exploit targeting Laravel’s deserialization mechanisms. Six distinct copied versions of the complaint submission form appeared in the directory. For a state actor, access to a live channel where citizens report grievances against government and institutions is a particular kind of intelligence prize.

In Taiwan, eight organizations in supply chain and defense-adjacent sectors were mapped and fingerprinted, with two successfully exploited. A chemical manufacturer was hit through SQL injection. A telecom and edge device manufacturer was compromised after attackers found hardcoded Supabase keys and Azure Logic App tokens in publicly accessible JavaScript files, giving them direct access to cloud infrastructure accounts. The reconnaissance script targeting these organizations ran DNS brute-forcing, certificate transparency queries, and HTTP service fingerprinting with an emphasis on VPN gateways, GitLab instances, and Jira environments.

The United States appeared at earlier stages of the operation rather than as a confirmed breach. NASA hosts launchpad.nasa[.]gov and ngis.nasa[.]gov were logged in network scanning output but not pursued further. Cloned pages impersonating the D.C. Council and Delaware County, Pennsylvania were recovered at varying levels of completion: the D.C. Council WordPress admin login page was fully built while the homepage was still missing images.

Hunt.io assessed the targeting of mid-tier government administrative bodies as consistent with documented Chinese intelligence collection priorities around procurement, vendor relationships, and policy visibility. The county contact form clone, specifically built to capture citizen submissions, fits that same pattern.

A parallel campaign hit financial services firms across Europe, Australia, and Asia. A CORS exploit page on one of the attacker-controlled servers successfully extracted WordPress administrator credentials from a large payment processing platform, with LinkedIn cross-referencing confirming the extracted account names matched real employees.

“In addition to the government-sector activity, the operators ran a parallel campaign against financial services firms across multiple regions. The clearest example being an attacker-developed CORS exploit page on 112.213.124[.]159 that successfully extracted WordPress administrator account data from a large payment processing platform.” states the report. “A cross-reference on the exposed accounts against public LinkedIn profiles, confirmed individuals with the same name as employees of the company.”

The 13 servers are all in Hong Kong, spread across four hosting providers: VMISS Inc., MEGA-II IDC, CTG Server Limited, and Antbox Networks Limited. Three share SSH host key fingerprints and ran identical ARL reconnaissance software serving the same default TLS certificate, with fields pointing to Shanghai. Two servers in the cluster also presented certificates self-identifying as “Gshell C2,” a previously undocumented C2 framework. Because those two servers overlap with the TencShell cluster, Hunt.io assesses with moderate confidence that Gshell is a second C2 framework operated in parallel by the same actors.

The malware recovered from the delivery ports was a previously unreported Linux/ARM 32-bit binary that communicates back to the same infrastructure hub over WebSocket. It’s capable of extracting Tencent QQ messaging credentials including SDK identifiers and cryptographic keys, enterprise messaging platform tokens, and cloud service access keys. A separate Linux/x86 variant uses the Go obfuscation tool garble to strip function names, but both variants share an identical 80-byte encryption key, pointing to a shared codebase across architectures.

“The campaign reflects an intermediate-to-advanced capability set: custom exploit development aimed at specific framework versions, multi-platform malware variants, and integration of LLMs for real-time attack assistance.” concludes the report. “Observable indicators: Simplified Chinese in code and documentation, Hong Kong infrastructure clustering, and multi-continent targeting, are consistent with China-based threat actor activity.”

Hunt.io notified the affected organizations and national CERTs on July 6, 2026, and held publication for a seven-day disclosure window. The full indicator set, including file hashes and network infrastructure, is in the original report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, LLM)

Hackers are using 15 malicious JetBrains plugins posing as AI coding assistants to steal DeepSeek, OpenAI, and other developer API keys.

Key takeaway. since the emergence of WormGPT in June 2023, AI-based hacking tools have spread to the dark web, Telegram, GitHub, and Hugging Face. the market has evolved into a mix of paid subscription SaaS and free open-source distributions. key capabilities have been segmented into phishing automation, malware development, reconnaissance, brute force, vulnerability exploitation, and […]

A little over two weeks ago, a largely unknown China-based company named DeepSeek stunned the AI world with the release of an open source AI chatbot that had simulated reasoning capabilities that were largely on par with those from market leader OpenAI. Within days, the DeepSeek AI assistant app climbed to the top of the iPhone App Store's "Free Apps" category, overtaking ChatGPT.

On Thursday, mobile security company NowSecure reported that the app sends sensitive data over unencrypted channels, making the data readable to anyone who can monitor the traffic. More sophisticated attackers could also tamper with the data while it's in transit. Apple strongly encourages iPhone and iPad developers to enforce encryption of data sent over the wire using ATS (App Transport Security). For unknown reasons, that protection is globally disabled in the app, NowSecure said.

Basic security protections MIA

What’s more, the data is sent to servers that are controlled by ByteDance, the Chinese company that owns TikTok. While some of that data is properly encrypted using transport layer security, once it's decrypted on the ByteDance-controlled servers, it can be cross-referenced with user data collected elsewhere to identify specific users and potentially track queries and other usage.

Read full article

Comments

© Getty Images

Italian and Irish regulators want answers on how data harvested by chatbot could be used by Chinese government

The Chinese AI platform DeepSeek has become unavailable for download from some app stores in Italy as regulators in Rome and in Ireland demanded answers from the company about its handling of citizens’ data.

Amid growing concern on Wednesday about how data harvested by the new chatbot could be used by the Chinese government, the app disappeared from the Apple and Google app stores in Italy with customers seeing messages that said it was “currently not available in the country or area you are in” for Apple and the download “was not supported” for Google, Reuters reported.

Continue reading...

© Photograph: Faisal Bashir/SOPA Images/REX/Shutterstock

© Photograph: Faisal Bashir/SOPA Images/REX/Shutterstock

© Photograph: Faisal Bashir/SOPA Images/REX/Shutterstock