Chinese Hackers Integrate Commercial AI Models into Espionage Campaigns
State-sponsored Chinese hackers are leveraging large language models like Claude Code and DeepSeek-v4-pro to automate and enhance their cyberespionage operations, marking a significant shift in threat actor tactics.
A sophisticated cyberespionage campaign attributed to Chinese state-sponsored actors has been discovered actively integrating commercial artificial intelligence (AI) large language models (LLMs) directly into their operational infrastructure. Unlike previous uses of AI for research or analysis, this campaign embeds models such as Anthropic's Claude Code and DeepSeek-v4-pro into the core execution flows of their operations, effectively turning them into autonomous agents for espionage.
The campaign, uncovered by researchers, pivots on known command-and-control (C2) infrastructure previously associated with the TencShell malware. Analysis of an exposed open directory revealed victim source code, custom exploit scripts, operator logs, and cloned login pages, all accompanied by simplified Chinese documentation. This trove of data provided critical insights into the novel use of AI within the threat actor's toolkit.
Researchers identified a distinct division of labor between the two LLMs. Claude Code was tasked with agentic tool interaction, managing interactive bash environments, executing terminal commands, and maintaining session persistence. This suggests the model was used to automate routine tasks and ensure continuous access to compromised systems. In contrast, DeepSeek-v4-pro was employed for higher-level functions, including attack reasoning, generating custom scripts, devising security evasion tactics, and adapting exploits in real-time.
Detailed instructions found within a central CLAUDE.md workspace file directed the automated agent to construct, test, and dynamically optimize targeted phishing infrastructure. Operational timelines from early June 2026 indicated dedicated active working environments tailored for intelligence gathering against Taiwan. This systematic approach aligns with a previous Anthropic security advisory from November 2025, which warned of China-linked actors using malicious developer tools for mass infrastructure intrusions.
Further investigation, initiated by a unique HTTP header fingerprint, uncovered a broader network of 13 primary servers across four Hong Kong-based Autonomous System Numbers (ASNs). These servers utilized overlapping SSH keys and TLS certificates for redundancy. Key collection nodes hosted an offensive toolkit including the ARL framework for network mapping, DeepAudit for vulnerability identification, and Vshell for remote administration, alongside an open repository containing thousands of stolen files.
The campaign also revealed an undocumented secondary framework, dubbed "Gshell," operating in parallel with TencShell, indicating the threat group maintained redundant C2 frameworks to ensure operational uptime. The targeted sectors and systems spanned various entities, including supply chain networks and manufacturing firms in Taiwan, government administrative nodes in Thailand, public applications in Afghanistan, and U.S. public sector subdomains. Exploitation vectors included SQL injection, RCE, and cross-origin resource sharing (CORS) attacks.
The combination of simplified Chinese developer logs, Hong Kong-based infrastructure, and targets aligned with state intelligence mandates strongly points to a China-based threat actor. This campaign represents a critical paradigm shift, demonstrating that commercial AI systems are evolving from passive research aids into active, force-multiplying components of sophisticated cyber attacks, raising significant concerns about the dual-use risks associated with agentic AI environments.