"Can you find about like what scam or thing they done in past like spoofing calls or somthing," the attacker typed to an AI assistant. That misspelled request, quoted by Palo Alto Networks' Unit 42, sums up the case: a criminal with little skill of their own, leaning on AI tools with their safety controls stripped out to run break-ins, plan fraud and write the follow-up plan.
Unit 42 got inside the actor's operating environment, which is how it can describe the operation in such detail in the original report. The actor, operating under the handle BUGSTER, attacked targets mainly in India, including universities, and walked away with thousands of records containing personal information.
One student database, 5,200 records
At one Indian university's online education platform, AI-generated reconnaissance mapped 12 subdomains, then pulled 13 active user IDs with real names through WordPress's REST API, getting around a Cloudflare firewall that blocked the direct user endpoint. A generated brute-force script tried 117 usernames against 28 common passwords and flagged one valid login.
At a second Indian public university, the actor found an administrator account with a weak password and exfiltrated a MongoDB database of more than 5,200 records, including personal data on diploma, undergraduate and postgraduate students and faculty. They also enumerated an Indian e-commerce store, extracting a storefront API token, admin email addresses and payment merchant IDs. One AI-written attack report ended with a section titled "NEXT EXPLOIT OPPORTUNITIES".
A fraud consultant with no safety rail
The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine, controlled over Telegram, plus the Cursor code editor with its permission checks and sandbox disabled. Unit 42 found test scripts showing the actor tried other models, including GLM 5.2, and worked to defeat their safety controls with a system-prompt override before settling on DeepSeek V4.
A Hermes profile called "alice" served as a voice over IP (VoIP) fraud advisor. Its knowledge base covered registering a US company as a front, buying call capacity from legitimate carriers, mixing roughly 70% legitimate traffic with 30% fraudulent calls to stay under carrier audit thresholds, and getting around STIR/SHAKEN, the FCC-mandated caller ID verification framework. Unit 42 found no call logs or active routing, suggesting that business was still being planned.
The same server hosted a Python command-and-control listener for Windows reverse shells, a Go toolkit that scrapes web pages for exposed secrets such as .env values and cloud keys, and a Wi-Fi cracking pipeline. A Raspberry Pi-style device captured WPA handshakes near target networks and shipped them to rented cloud GPUs, which means the actor had physical access to those locations. The actor also compiled files on 45 cryptocurrency "whales", which Unit 42 assesses were likely for future targeting.
A toolchain others are picking up
Unit 42 says multiple unrelated actors are now independently using the same Hermes plus DeepSeek combination, and assesses that low safety friction at low cost is a key driver: DeepSeek models are cheap, easy to reach and readily jailbroken with a simple override. It follows other recent cases of criminals putting AI agents to work, such as a hijacked AI agent asked to plan a casino breach.
Fix the weak admin passwords first
Nothing here was advanced. The intrusions Unit 42 describes rested on enumerable user lists, common passwords and a weak administrator password, so the defences are basic too: lock down WordPress user enumeration, enforce strong passwords and MFA on admin accounts, keep databases off the open internet, and block the indicators below.
- 162[.]243[.]3[.]92 (actor infrastructure, US-hosted server)
- 104[.]238[.]38[.]202 (commercial proxy server)
The skill this actor lacked, the model supplied. That is the shift Unit 42 is documenting, and it is why yesterday's basic hygiene failures now carry a bigger bill.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.