We hear about cybercriminals using artificial intelligence practically every day. However, it is worth remembering that the term “AI-powered attack” can refer to many different types of malicious activity – from generating more convincing phishing messages, cloning someone’s voice or creating a deepfake, to using language models to write code, conduct reconnaissance or automate subsequent stages of an attack.
We have selected four cases in which cybercriminals used AI that demonstrate how artificial intelligence lowers the barrier to entry, accelerates malicious activity and enables attacks to be carried out at a larger scale.
GTG-1002: when Claude Code became part of a cyberespionage campaign
The attackers found a way to bypass Claude Code’s safeguards. Among other techniques, they used role-playing – presenting themselves as employees of legitimate cybersecurity companies and convincing the model that it was performing tasks related to defensive security testing. As a result, individual actions appeared to be ordinary technical tasks, while Claude did not have the full context of the overall operation.
AI was then used at virtually every stage of the attack: conducting reconnaissance, mapping the attack surface, identifying vulnerabilities, generating payloads, testing exploits, obtaining credentials, performing lateral movement, analysing stolen data and supporting its exfiltration. Claude also automatically documented the progress of the operation, allowing subsequent operators to continue the attack.
The scale was significant – the campaign targeted around 30 organisations across multiple countries, including major technology companies, financial institutions, chemical companies and government agencies. Anthropic confirmed that some of these targets were successfully compromised.
What is particularly interesting, however, is the proportion of work performed by humans compared with AI. According to Anthropic’s analysis, Claude independently carried out approximately 80–90% of tactical activities, while human operators accounted for only around 10–20%. Human involvement remained primarily at the strategic level – selecting targets and approving key moments, such as moving from reconnaissance to active exploitation, using acquired credentials or determining the final scope of data exfiltration.
Deepfake video conference leads to a $25 million loss
In 2024, British engineering company Arup fell victim to one of the most high-profile fraud cases involving deepfake technology. It all began with a message received by an employee in the company’s Hong Kong finance department from someone impersonating the company’s CFO. The message concerned a confidential transaction. Initially, the employee became suspicious – the situation resembled a classic phishing attempt.
A video conference was supposed to dispel those doubts. During the call, the employee saw the CFO and several other colleagues whom they recognised. Their faces and voices appeared authentic, so the employee concluded that the instruction genuinely came from the company’s management.
The problem was that the people participating in the call were deepfakes. The fraudsters used artificial intelligence to impersonate company representatives using fabricated video and audio. Arup later confirmed that fake voices and images had been used in the attack.
What happened next? The employee made 15 transfers totalling HKD 200 million – approximately USD 25.6 million – to five bank accounts. It was only after contacting the company’s headquarters that the employee discovered the entire operation had been fraudulent.
Interestingly, Arup’s systems were not compromised in the process. The company confirmed that its internal systems had not been breached and that the incident had no impact on its business operations or financial stability.
The incident became one of the most widely recognised examples of deepfake-related threats and helped highlight the need for additional verification of unusual requests, particularly those involving money transfers, access to data or other sensitive operations. Increasing emphasis has since been placed on the principle of “verify through another channel” – confirming an instruction through an independent communication channel in accordance with a previously established procedure.
AI helped a hacker compromise more than 600 Fortinet devices across 55 countries
Between January 11 and February 18, 2026, an attacker reportedly gained access to more than 600 Fortinet FortiGate devices across 55 countries. Importantly, the attacker searched for Internet-exposed administrative interfaces and compromised devices protected by weak passwords where MFA had not been implemented.
Artificial intelligence began to play a larger role during subsequent stages of the operation. The attacker used AI models to plan activities, develop custom tools in Go and Python, analyse acquired configurations, conduct reconnaissance and prepare subsequent steps that enabled movement through compromised networks.
This case therefore illustrates one of the biggest challenges associated with the offensive use of AI: artificial intelligence lowers the barrier to entry for cybercrime.
PROMPTSTEAL – malware that asked AI which commands to execute during an attack
What made this case particularly notable was that AI was not used solely to develop the malware.
The malware communicated with a large language model while actively running on an infected device.
PROMPTSTEAL accessed the Qwen2.5-Coder-32B-Instruct model via the Hugging Face API. Instead of having all commands hard-coded in advance, the malware sent prompts to the model, which generated Windows commands required, among other things, to collect system information and search for documents. The generated commands were then executed on the victim’s device, and the collected data was sent to a server controlled by the attackers.
According to Google, this was the first case observed by GTIG of malware using an LLM during a live operation.
What do these cases have in common?
These four cases demonstrate that when we talk about AI in cyberattacks, we are no longer discussing only a potential threat or hypothetical future scenarios. Artificial intelligence is already being used in real-world operations – and at very different stages of the attack lifecycle. It can help create convincing deepfakes, write or develop malware, analyse stolen data, plan subsequent actions and even perform a significant proportion of the tasks involved in an active cyber campaign.
Text autor:
