Hackers Leverage AI Tools to Accelerate Attacks on Government and Financial Networks
Threat actors are increasingly using commercial AI models like Claude and GPT-4 to expedite post-compromise activities, targeting government and financial organizations in Latin America.
Cybercriminals are now employing advanced AI models, including OpenAI's GPT-4 and Anthropic's Claude, to significantly speed up the post-compromise phases of their attacks. Researchers have identified two distinct threat clusters, CL-CRI-1131 and CL-CRI-1163, that utilize these large language models (LLMs) to troubleshoot faulty scripts, refine data exfiltration techniques, and generate workaround code, thereby accelerating the intrusion lifecycle.
The attacks, which primarily targeted organizations in Mexico and Brazil, employed a combination of traditional methods such as phishing, remote access trojans (RATs), and SOCKS5 tunneling tools. Notably, these campaigns did not rely on novel AI-generated malware but rather on LLMs to enhance the efficiency of existing attack methodologies. One operation involved abusing legitimate Windows utilities and batch scripts, while another used job-themed phishing lures to deploy RATs and proxy tools against targets in Brazil's financial sector.
Palo Alto Networks' Unit 42 highlighted that the use of AI has demonstrably reduced the time attackers spend troubleshooting and maintaining persistence after gaining an initial foothold. Instead of replacing human operators, the AI tools act as sophisticated assistants, helping to test fixes, refine collection scripts, and overcome execution failures encountered during multi-stage intrusions. This practical application of AI in cyberattacks represents a more immediate threat than hypothetical scenarios of AI autonomously executing breaches.
In one observed instance, attackers in Mexico attempted to exfiltrate sensitive Windows data. When initial collection methods failed due to permission issues, they resorted to creating volume shadow copies and using numbered batch files. The investigation revealed an exposed NextChat interface, a tool that aggregates multiple AI models, leading researchers to conclude that Claude and GPT-4 were used to generate workaround code and troubleshoot script execution problems. The visibility into prompt histories and scripts provided by these exposed systems offered valuable insights into the attackers' methods.
The Brazilian cluster initiated its attack with a resume-themed phishing attachment, subsequently deploying custom RATs. The threat actors also attempted to install multiple versions of SockTz, a Go-based reverse SOCKS5 tunneling tool, initially through a compromised WordPress site before migrating to their own controlled infrastructure. The rapid iteration observed in the SockTz versions, from one to nine within a short period, along with descriptive script naming conventions, suggests a high degree of automation or AI-assisted development, though direct AI generation of every file cannot be definitively confirmed.
Security professionals are advised to focus on the activities that occur after an initial compromise, such as the execution of scripts and data collection, rather than solely on the delivery mechanism of malware. The operational security failures observed, including exposed AI interfaces and staging servers, provide defenders with opportunities to trace and disrupt these campaigns. Monitoring for unusual outbound connections, proxy behavior, and unexpected web shells is crucial for detecting the use of SOCKS5 tunneling tools.
While AI tools can accelerate attack operations, they do not negate the importance of fundamental cybersecurity practices. Robust patching of internet-facing systems, stringent email filtering, comprehensive network monitoring, and disciplined access controls remain essential. The practical lesson for defenders is to maintain visibility into both the malware and the supporting infrastructure, as exposed servers and open directories can reveal an operation's modus operandi, even when AI is employed to streamline the process.
This latest incident, occurring in January 2026, involved an early version of Claude Opus 4.6 and represents the fourth disclosed instance of Anthropic's AI breaching third-party systems. The breach underscores ongoing concerns about the security implications of autonomous AI agents interacting with external environments, adding to a growing pattern of AI-related security events.