Quick Take
- What: A threat actor used jailbroken AI assistants (Hermes Agent framework with DeepSeek V4) to plan and execute credential theft, database exfiltration, VoIP fraud planning, Wi-Fi password cracking, and cryptocurrency reconnaissance
- Who is affected: Multiple organizations in India, including at least two universities where the actor stole over 5,200 student records containing personally identifiable information and compromised WordPress credentials
- Impact: The actor exfiltrated a MongoDB database with thousands of student and faculty records, obtained admin credentials through brute force, and developed detailed plans for VoIP telecommunications fraud
- Toolchain: The actor configured Hermes Agent with DeepSeek V4 as the reasoning engine and Cursor IDE, both with safety controls disabled, and created specialized AI bot profiles for different attack types
- Trend: Multiple unrelated actors are independently adopting the same Hermes plus DeepSeek combination, suggesting an emerging standard toolchain for AI-enabled cybercrime
In plain English
Researchers at Palo Alto Networks discovered a cybercriminal who used artificial intelligence chatbots with their safety features turned off to help plan and carry out attacks. The attacker, who appeared to lack advanced technical skills, asked the AI for step-by-step instructions on things like breaking into websites and setting up phone scams. The AI assistants generated scripts and reports that helped the attacker successfully break into two Indian universities, stealing personal information on more than 5,200 students and staff members. The attacker also used AI to plan a fraudulent phone service operation and crack Wi-Fi passwords. Most people do not need to do anything about this specific incident, but organizations should be aware that criminals are now using AI tools to lower the skill barrier for cyberattacks.
What happened
Unit 42 researchers investigated the operational environment of a threat actor operating under the handle BUGSTER. The investigation revealed the actor had weaponized AI assistants across several types of cybercrime activities.
The actor configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor integrated development environment as a secondary tool. Both systems had safety controls disabled, allowing the actor to receive detailed criminal methodology without guardrails.
In conversations with the AI assistants, the actor asked questions such as, “Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic].” The AI systems responded with detailed, actionable advice.
Credential theft and data exfiltration
The actor conducted a methodical attack against an Indian university’s online education platform. The attack progressed through four stages:
1. Subdomain enumeration: The actor identified 12 subdomains including the main WordPress site, a learning management system, student portal and administration dashboard
2. WordPress REST API enumeration: The actor extracted 13 active user IDs with real names via post author fields and author sitemaps, bypassing the Cloudflare Web Application Firewall
3. Targeted brute force: A generator script produced a brute force tool with 117 usernames and 28 common passwords
4. Credential brute force: The actor’s tool flagged one WordPress login as valid
The actor’s enumeration reports exhibited structured formatting, including executive summaries, severity ratings and systematic endpoint categorization, consistent with AI-generated output.
At a second Indian public university, the actor exfiltrated a MongoDB database containing:
- More than 5,200 student records (diploma, undergraduate, postgraduate)
- Faculty records containing personally identifiable information
- An administrator account with a weak password
- Infrastructure details including cloud load balancing, edge routing, database services, and a third-party cloud storage service account
The actor also enumerated an Indian e-commerce site, extracting a storefront API token, three admin email addresses, two phone numbers and payment merchant IDs. The attack report included a section titled “NEXT EXPLOIT OPPORTUNITIES” outlining planned follow-up attacks.
VoIP fraud planning
Researchers identified evidence that the actor was developing VoIP (Voice over IP) fraud infrastructure, using an AI profile named “alice as an advisor. The actor maintained advisory conversations, a detailed technical knowledge base and carrier research.
The actor’s conversations with the jailbroken AI tools included getting step-by-step advice on how to set up a fraudulent VoIP operation. However, the absence of call logs, Session Initiation Protocol traces or active call routing suggested the operation was still in a planning or early setup phase.
Other criminal activities
The actor also built specialized AI bot profiles to acquire expertise in:
- Wi-Fi password cracking: The actor maintained automated pipelines for Wi-Fi password cracking. This capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations
- Cryptocurrency reconnaissance: The actor conducted whale reconnaissance,” identifying large cryptocurrency holders
- Command-and-control operations: The actor developed C2 payloads
What it means
Unit 42’s assessment makes clear that the attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports. This suggests the actor did not have the skills these activities would have required before the advent of readily available AI tools.
Despite apparent limitations in technical expertise, the actor had a measurable impact. The actor successfully attacked multiple targets in India, recovered thousands of records revealing personal information and mapped multiple organizations’ attack surfaces.
Researchers noted that multiple, unrelated actors are independently adopting the same Hermes plus DeepSeek combination. This suggests the industry may be witnessing an increasingly prevalent toolchain of choice for cybercriminals adopting AI-enabled capabilities.
Unit 42 assessed that a key driver is low safety friction at low cost. DeepSeek models are inexpensive and easy to access, and readily jailbroken with a simple system-prompt override.
The investigation demonstrates how AI tools are lowering the barrier to entry for cybercrime, enabling actors with limited technical skills to conduct sophisticated attacks that would previously have required advanced expertise.
