hackingincidents.ai

Jan 2023 – Oct 2026 · every case sourced

95 attacks where AI was in the loop

Every publicly documented cyberattack, intrusion and fraud operation we found since 2023 where attackers used AI, or almost certainly did. Each one is graded by how strong the evidence is, names the model the source names, and links to the reports behind it. These are published cases as of 23 Oct 2026, not a rate: a model only shows up here when someone with visibility reports it.

Confirmed 64Strong 29Suspected 2

Incidents by month the activity began or was disclosedConfirmedStrongSuspected

2023202420252026

54%first reported by an AI or platform maker about its own service (Anthropic is named most, in 22)

Malware devmost common thing the AI did (38)

39%attributed to nation-state actors

77%name a specific model or tool

Grade

AI role

Model

Actor

95 of 95 incidents

DateIncidentWhat the AI didModelGrade

AiPT-67 'CyberCartel' builds CARLIY0S on PentAGI against Latin American banks

AiPT-67 (CyberCartel) → Latin American banks and financial institutions (title cites 400+) per Straiker

ReconExploit devAgentic intrusionOps automation

Kimi, Claude Sonnetstated by researcher

Attacker hijacks developer's live AI coding session to spread Shai-Hulud worm

Unnamed → A SaaS provider and its developers (about 100 internal repos) per Mandiant / Google Cloud

Agent hijackSupply chainMalware devOps automation

unspecified LLMunknown

Chinese operators ran an AI exploit foundry and agent swarms

GTG-10007 · China → About fifty organizations including Southeast Asian government agencies per Anthropic

Vuln researchExploit devReconAgentic intrusion

Claudestated by vendor

Midnight Blizzard-linked GTG-20006 automated espionage and malware rebuilds

GTG-20006 (consistent with Midnight Blizzard) · Russia → Ukrainian and European governments, defense, drone suppliers per Anthropic

ReconAgentic intrusionMalware devEvasion

Claude Code, Claudestated by vendor

Iran-nexus GTG-30004 built OSINT profiling and obfuscated NanoDump

GTG-30004 · Iran → Israeli officials and Jewish diaspora organizations per Anthropic

ReconMalware devEvasionData analysis

Claudestated by vendor

ShinyHunters affiliates used Claude for mass smash-and-grab breaches

GTG-50014 (suspected ShinyHunters affiliates) → SaaS vendors, an airline, a technology provider and others per Anthropic

Agentic intrusionExploit devData analysisOps automation

Claudestated by vendor

GTG-50020 injected prompts into an AI vendor sandbox to steal API keys

GTG-50020 · Russia (Russian-speaking) → Hotel booking and fintech platforms; about thirty AI companies per Anthropic

Agentic intrusionOps automationExploit devAgent hijack

Claudestated by vendor

Fraudulent cheap-Claude reseller harvests Anthropic credentials

GTG-50021 (alias kl1zy) → Customers seeking discounted Claude access per Anthropic

FraudLLMjacking

Claude (impersonated), unspecified substitute modelstated by vendor

BASIN CASTLE used LLMs for recon, lures and obfuscated malware

BASIN CASTLE (BASIN, TEMP.Hex) · China → High-value targets per Google Threat Intelligence Group

ReconPhishing contentMalware dev

Geministated by vendor

MIDNIGHT NEPTUNE used LLMs for RATs, lures and lateral movement

MIDNIGHT NEPTUNE (formerly UNC1069) · North Korea → Cryptocurrency organizations per Google Threat Intelligence Group

Malware devSocial engineeringOps automation

Gemini, DeepSeek-Coderstated by vendor

PRC group chained Claude, Gemini and Codex into an exploitation pipeline

PRC-nexus espionage group (unnamed) · China → Government entities per Google Threat Intelligence Group

Exploit devPhishing contentOps automation

Claude, Geministated by vendor

Exposed 'Recon' framework used AI agents to harvest 23,800 secrets

Unattributed → Server-side infrastructure; cloud and AI service keys per Google Threat Intelligence Group

Agentic intrusionVuln researchOps automation

unspecified LLM agents (OpenClaw-style agent files)stated by vendor

SANDWORM RELIC integrated Gemini into operations against Ukraine

SANDWORM RELIC (APT44) · Russia → Ukraine per Google Threat Intelligence Group

ReconSocial engineeringOps automation

Geministated by vendor

ShinyHunters cluster UNC6240 used AI across SaaS extortion attacks

UNC6240 (ShinyHunters) → SaaS customers per Google Threat Intelligence Group

Ops automationData analysis

Geministated by vendor

AI agents execute full ransomware intrusion in under ten hours

Unidentified extortionist → An enterprise network breached through an exposed API endpoint, then cloud, CI/CD and secrets manager per Resultsense (via The Register, reporting Unit 42)

Agentic intrusionReconOps automationExploit dev

unspecified frontier models and agentic frameworksstated by researcher

Eleven nations warn DPRK IT workers use real-time deepfakes in interviews

North Korean IT workers · North Korea → Employers hiring remote staff per TechTimes

DeepfakeSocial engineeringFraud

unspecified real-time face-swap toolstated by researcher

CyberXero initial access broker runs 51 Claude Code agents plus PentAGI

CyberXero · Russia (medium confidence per SOCRadar) → Ukrainian energy and utilities, plus mass WordPress/e-commerce scanning per SOCRadar

ReconExploit devAgentic intrusionOps automation

Claude Code, PentAGI via an AI provider APIstated by researcher

Open-source AI agents breach online retailers and plant card skimmers

Unnamed financially motivated operator → Online retailers (at least 27 compromised; a US airline and hospitality firm among those named in coverage) per Hackread (reporting Gambit Security)

Vuln researchExploit devAgentic intrusionOps automation

Strix, Cairnstated by researcher

'Skynet' agent hijacks exposed LLM endpoints to power autonomous attacks

Unnamed operators → Exposed LLM endpoints (honeypot) and internet-facing web frameworks per Symantec (security.com)

LLMjackingAgentic intrusionReconExploit dev

unspecified commercial and exposed LLMsunknown

Attacker uses someone else's exposed Ollama server as the brain of an offensive pipeline

Unnamed (VAPT framework) → Victim's exposed Ollama server; probe targets were practice and lab ranges per Sysdig

LLMjackingAgentic intrusionExploit dev

Ollama-hosted model (not named in the page I verified)unknown

Vibe-coded PowerShell script maps Active Directory during intrusion

Unidentified → Victim organization accessed via compromised remote credentials over RDP per Huntress

Malware devRecon

unspecified AI chatbotinferred

JadePuffer: LLM agent runs an entire extortion operation from Langflow exploit to data destruction

JadePuffer (Sysdig name) → Internet-facing Langflow instance, then an exposed MySQL and Alibaba Nacos production server per The Register

Agentic intrusionExploit devOps automation

unspecified LLMunknown

APT27 uses Gemini to build relay-network management tool

APT27 · China → Own operational relay box (ORB) infrastructure per Google Threat Intelligence Group

Malware devEvasion

Google Geministated by vendor

DPRK and PRC clusters use Gemini and agent tools for scaled vulnerability research

APT45; UNC2814 · North Korea (APT45); PRC-associated (UNC2814) → Embedded devices (TP-Link firmware, OFTP implementations) and CVE/PoC validation per Google Threat Intelligence Group

Vuln researchExploit dev

Google Gemini, OpenClawstated by vendor

Russia-nexus malware with LLM-generated decoy code targets Ukraine

Suspected Russia-nexus actors · Russia → Ukrainian organizations per Google Threat Intelligence Group

Malware devEvasion

unspecified LLMinferred

PROMPTSPY Android backdoor drives the phone UI through Gemini

Unnamed → Android users per Google Threat Intelligence Group

LLM inside malwareAgentic intrusionEvasion

Google gemini-2.5-flash-lite, Google Geministated by vendor

Criminals build 2FA-bypass zero-day with AI for planned mass exploitation

Unnamed prominent cybercrime actors → Popular open-source web-based system administration tool (unnamed) per Google Threat Intelligence Group

Vuln researchExploit dev

unspecified LLMinferred

China-based studio ran 20+ dating apps with AI personas to defraud users

GTG-15001 · China → Dating app users per Anthropic

FraudSocial engineering

Claude, image-editing modelstated by vendor

A hacktivist used Claude to breach European political entities

GTG-50029 → European political parties, media, think tanks and their SaaS providers per Anthropic

Exploit devAgentic intrusionMalware devData analysis

Claude, other AI models for vetting findingsstated by vendor

APT36 mass-produces 'vibeware' implants with AI tools

APT36 / Transparent Tribe · Pakistan → Indian government networks and related entities per Dark Reading (reporting Bitdefender 'APT36: A Nightmare of Vibeware')

Malware devEvasionOps automation

unspecified LLMs and AI coding toolsunknown

Fideuram chairman tricked by cloned voice and fake CEO messages into EUR 95M transfers

unknown → Fideuram - Intesa Sanpaolo Private Banking per Gulf News

DeepfakeFraudSocial engineering

unspecified voice-clone/deepfake toolstated by researcher

APT31 drove Gemini with Hexstrike MCP tooling against US targets

APT31 · China → US-based targets per Google Threat Intelligence Group

Vuln researchExploit devOps automation

Gemini, Hexstrike MCPstated by vendor

Slopoly: likely AI-generated PowerShell backdoor in Hive0163 ransomware attack

Hive0163 → Enterprise victim of ClickFix-initiated ransomware intrusion per IBM X-Force

unspecified LLMunknown

UAT-10147 uses PentestGPT, DeepAudit and AI-written scripts against web servers

UAT-10147 · China (Chinese-speaking) → About 170,000 target URLs; Windows and Linux web servers worldwide (Brazil, Bolivia, China, Canada, Vietnam seen) per Cisco Talos

ReconExploit devOps automationAgentic intrusion

PentestGPT, DeepAuditstated by researcher

UNC1069 hits crypto fintech with fake Zoom and apparent deepfake CEO video

UNC1069 (CryptoCore / MASAN) · North Korea → Cryptocurrency fintech and Web3 firms, macOS host per Google Cloud / Mandiant

DeepfakeSocial engineeringPhishing content

unspecified voice-clone/deepfake tool, Geministated by researcher

Hacker uses Claude Code and GPT-4.1 to breach nine Mexican government bodies

Unnamed single operator → Nine Mexican federal, state and municipal organizations incl. tax authority SAT and electoral institute INE per Gambit Security

ReconExploit devAgentic intrusionData analysis

Claude Code, OpenAI GPT-4.1stated by researcher

AI-assisted AWS intrusion reaches admin in under 10 minutes

Unnamed actor (Serbian-language comments in injected code) → One AWS customer environment (RAG data buckets, Lambda, Bedrock) per Sysdig

ReconExploit devOps automationLLMjacking

unspecified LLMinferred

QUIETVAULT stealer used on-host AI CLI tools to hunt secrets

Unattributed → GitHub and NPM token holders per Google Threat Intelligence Group

LLM inside malware

unspecified LLM (on-host AI CLI tools)stated by vendor

TEMP.Zagros used Gemini to research custom malware

TEMP.Zagros (MuddyWater) · Iran → Phishing victims per Google Threat Intelligence Group

Geministated by vendor

North Korean UNC1069 used Gemini and deepfake lures for crypto theft

UNC1069 (MASAN) · North Korea → Cryptocurrency users and industry per Google Threat Intelligence Group

ReconMalware devDeepfakeSocial engineering

Geministated by vendor

UNC4899 used Gemini for exploit research and tooling

UNC4899 (PUKCHONG) · North Korea → Edge devices and browsers (likely) per Google Threat Intelligence Group

Exploit devVuln researchMalware dev

Geministated by vendor

COINBAIT crypto-exchange phishing kit built with AI code generation

UNC5356 overlap → Cryptocurrency exchange users per Google Threat Intelligence Group

Phishing contentMalware dev

unspecified LLM (AI code generation tools)stated by vendor

VoidLink: advanced Linux cloud malware framework built almost entirely by AI

Unnamed single developer · China → Cloud workloads on AWS, GCP, Azure, Alibaba, Tencent; Docker/Kubernetes per Check Point Research

Malware devEvasion

TRAE SOLO (AI assistant in the TRAE IDE)stated by researcher

Korean-language operators sought ChatGPT help for malware and C2

Korean-language operator cluster (overlaps Trellix reporting) · North Korea (suspected) → South Korean diplomatic missions per OpenAI

Malware devPhishing content

ChatGPTstated by vendor

Russian-speaking criminals vibe-coded RAT and stealers with ChatGPT

Russian-speaking criminal operator · Russia → Unspecified per OpenAI

Malware devEvasion

ChatGPTstated by vendor

UNK_DROPPITCH/UTA0388 operators used ChatGPT for phishing and tools

UNK_DROPPITCH / UTA0388 · China → Taiwan semiconductors, US academia and think tanks per OpenAI

Phishing contentMalware dev

ChatGPTstated by vendor

Shai-Hulud npm worm: malicious bash script likely LLM-generated

Unknown (Shai-Hulud) → npm maintainers and packages, wide ecosystem per Unit 42, Palo Alto Networks

Malware devSupply chain

unspecified LLMinferred

Chinese state group ran largely autonomous espionage campaign via Claude Code

Chinese state-sponsored group (Anthropic: GTG-1002) · China → About thirty targets: tech companies, financial institutions, chemical manufacturers, government agencies per Anthropic

ReconAgentic intrusionExploit devData analysis

Claude Codestated by vendor

Criminals discuss weaponizing HexStrike AI against Citrix NetScaler zero-days

Underground forum actors (later attributed in press to Storm-1575) → Citrix NetScaler ADC/Gateway (CVE-2025-7775, -7776, -8424) per Check Point

Vuln researchExploit devAgentic intrusionOps automation

unspecified LLMs via HexStrike AI MCP serverunknown

HONESTCUE malware outsourced stage-two code generation to Gemini

Unattributed → Unspecified per Google Threat Intelligence Group

LLM inside malwareEvasion

Geministated by vendor

EvilAI: fake productivity apps built with AI-generated code

EvilAI operators → Organizations worldwide; manufacturing, government, healthcare per Trend Micro

Malware devEvasion

unspecified AI toolsunknown

s1ngularity: Nx npm compromise runs victims' AI CLIs to hunt secrets

Unknown (s1ngularity) → Developers installing malicious Nx npm versions; thousands of GitHub accounts per StepSecurity

Supply chainAgentic intrusionRecon

Claude Code CLI, Gemini CLIstated by researcher

Credential phishing campaign with LLM-obfuscated SVG payload

Unnamed → Mostly US organizations, via compromised small-business email account per Microsoft Security Blog

Phishing contentEvasionMalware dev

unspecified LLMinferred

CrowdStrike: Famous Chollima uses real-time deepfakes and GenAI at 320+ companies

Famous Chollima · North Korea → Hundreds of companies hiring remote IT workers per Fortune

DeepfakeSocial engineeringFraud

unspecified real-time face-swap toolstated by researcher

North Korean IT workers used Claude to get and keep Western tech jobs

North Korean IT worker operatives · North Korea → US Fortune 500 technology companies per Anthropic

FraudSocial engineering

Claudestated by vendor

Malicious wiper prompt shipped in Amazon Q Developer VS Code extension

lkmanka58 (alias) → Amazon Q Developer extension for VS Code (about 1M installs), release 1.84.0 per Amazon Web Services

Supply chainAgentic intrusion

Amazon Q Developer agent (target of the prompt)stated by researcher

Kimsuky phishing uses ChatGPT-made fake South Korean military IDs

Kimsuky (APT43) · North Korea → South Korean defense-related institutions, journalists, researchers, activists per Genians Security Center

DeepfakePhishing contentSocial engineering

ChatGPTstated by researcher

Vibe-hacking data extortion of 17 organizations with Claude Code

Unnamed cybercriminal (tracked by Anthropic in its full report as GTG-2002) → At least 17 organizations: healthcare, emergency services, government, religious institutions per Anthropic

ReconAgentic intrusionData analysisOps automation

Claude Codestated by vendor

Koske Linux cryptominer shows signs of AI-assisted development

Unnamed (Koske) → Misconfigured JupyterLab instances per Aqua Security

Malware devEvasion

unspecified LLMinferred

Microsoft: Jasper Sleet uses Faceswap and voice changers for fake IT workers

Jasper Sleet (and Coral Sleet) · North Korea → Western employers hiring remote IT staff per Microsoft

Social engineeringDeepfakeFraud

Faceswap, unspecified voice-changing softwarestated by researcher

OpenAI bans accounts tied to North Korea-style IT worker employment scheme

Suspected DPRK-linked IT worker campaigns · North Korea → Remote IT and software jobs worldwide per Korea Herald

Social engineeringFraud

ChatGPTstated by researcher

APT28 deployed PROMPTSTEAL, malware that queries an LLM for commands, against Ukraine

APT28 (FROZENLAKE) · Russia → Ukraine per Google Threat Intelligence Group

LLM inside malwareData analysisOps automation

Qwen2.5-Coder-32B-Instruct (via Hugging Face API), Qwen2.5-Coder-32B-Instructstated by vendor

BlueNoroff uses deepfaked executives in Zoom call to infect crypto employee

BlueNoroff / TA444 / Sapphire Sleet (Huntress: STARDUST CHOLLIMA) · North Korea → Cryptocurrency foundation employee (macOS) per BleepingComputer

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolstated by researcher

PROMPTFLUX malware rewrote itself hourly through the Gemini API

Unattributed (financially motivated indicators) → Broad, industry-agnostic lures per Google Threat Intelligence Group

LLM inside malwareEvasion

Gemini (gemini-1.5-flash-latest)stated by vendor

Impostor uses AI voice of Marco Rubio on Signal

unknown → Three foreign ministers, a US governor, a member of Congress per CBS News

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolstated by victim

Impersonator of Trump chief of staff Susie Wiles calls officials

unknown → Senators, governors and executives contacted as Susie Wiles per Yahoo News

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolinferred

FBI warns of AI voice messages impersonating senior US officials

unknown → Current and former senior US federal and state officials and their contacts per FBI IC3

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolstated by researcher

Unit 42: North Korean IT workers use real-time deepfakes in interviews

North Korean IT workers (Wagemole) · North Korea → Employers hiring remote staff per Palo Alto Networks Unit 42

DeepfakeSocial engineeringFraud

unspecified real-time face-swap toolstated by researcher

Singapore finance director sends US$499K after deepfake Zoom call

unknown → Unnamed multinational's Singapore finance director per Mothership.sg

DeepfakeFraudSocial engineering

unspecified voice-clone/deepfake toolunknown

Actor used Claude to build scrapers for leaked IoT camera credentials

Unnamed sophisticated actor → Internet-facing security cameras per Anthropic

ReconMalware devOps automation

Claudestated by vendor

Novice actor built an evasive malware builder with Claude

Unnamed novice actor → Unspecified per Anthropic

Malware devEvasion

Claudestated by vendor

Recruitment fraud campaign used Claude to polish scam messages

Unnamed actor → Job seekers in Eastern Europe per Anthropic

FraudSocial engineeringPhishing content

Claudestated by vendor

Italian defence minister's cloned voice used to solicit tycoons

unknown → Italian business leaders (Moratti, Armani, Prada and others) per Euronews

DeepfakeFraudSocial engineering

unspecified voice-clone/deepfake toolunknown

APT42 used Gemini for phishing content and defense-expert recon

APT42 · Iran → Defense experts and a US defense organization per Google Threat Intelligence Group

ReconPhishing contentVuln research

Geministated by vendor

North Korean APTs used Gemini across attack phases and IT-worker fakery

Nine North Korea-backed groups · North Korea → South Korea and US organizations; Western employers per Google Threat Intelligence Group

ReconMalware devEvasionFraud

Geministated by vendor

PRC-backed APT groups used Gemini for recon, scripting and post-compromise research

Over 20 China-backed groups · China → Unspecified targets per Google Threat Intelligence Group

ReconMalware devVuln researchEvasion

Geministated by vendor

Russian APT actors used Gemini to port and encrypt malware code

Russian government-backed APT actors · Russia → Unspecified per Google Threat Intelligence Group

Geministated by vendor

Low-skill actor sold Claude-built ransomware for $400-$1200

Unnamed cybercriminal (tracked by Anthropic in its full report as GTG-5004) → Buyers on cybercrime forums per Anthropic

Malware devEvasion

Claudestated by vendor

Vidoc Security interviews two deepfake job candidates

unknown (possible DPRK link) → Vidoc Security Lab (hiring) per The Pragmatic Engineer

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolstated by victim

FunkSec ransomware group builds tools with AI assistance

FunkSec · Algeria → Global victims across sectors, 85+ leak-site victims in Dec 2024 per Check Point Research

unspecified LLMinferred

Wiz employees get deepfake voice messages from CEO

unknown → Wiz (cloud security), dozens of employees per TechCrunch

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolstated by victim

Senator Cardin targeted by deepfake of Ukraine's ex-foreign minister

unknown → US Senate Foreign Relations Chair Ben Cardin per NBC News

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolunknown

KnowBe4 hires North Korean IT worker using AI-enhanced photo

North Korean IT worker scheme · North Korea → KnowBe4 (security awareness) per KnowBe4

Social engineeringDeepfake

unspecified AI image-enhancement toolstated by victim

Ferrari executive foils CEO voice-clone call

unknown → Ferrari executive per Jalopnik

DeepfakeSocial engineeringFraud

unspecified voice-clone/deepfake toolstated by researcher

AsyncRAT campaign with GenAI-written VBScript and JavaScript

Unnamed → French-speaking users, invoice-themed phishing per HP Wolf Security

unspecified GenAIunknown

WPP CEO impersonated with voice clone in fake Teams meeting

unknown → WPP (advertising) per The Guardian

DeepfakeSocial engineeringFraud

unspecified voice-clone/deepfake toolstated by victim

LastPass employee targeted with deepfake CEO voice call

unknown → LastPass employee per LastPass

DeepfakeSocial engineering

unspecified voice-clone/deepfake toolstated by victim

TA547 delivers Rhadamanthys stealer with likely LLM-written PowerShell

TA547 → German organizations, invoice lure impersonating retailer Metro per Proofpoint

unspecified LLMinferred

Charcoal Typhoon used ChatGPT for research, scripting and phishing content

Charcoal Typhoon · China → Government and defense-related targets (per source) per OpenAI

ReconMalware devPhishing content

ChatGPT (OpenAI services)stated by vendor

Crimson Sandstorm used ChatGPT for research, scripting and phishing content

Crimson Sandstorm · Iran → Government and defense-related targets (per source) per OpenAI

Malware devPhishing contentEvasion

ChatGPT (OpenAI services)stated by vendor

Emerald Sleet used ChatGPT for research, scripting and phishing content

Emerald Sleet · North Korea → Government and defense-related targets (per source) per OpenAI

ReconVuln researchPhishing content

ChatGPT (OpenAI services)stated by vendor

Forest Blizzard used ChatGPT for research, scripting and phishing content

Forest Blizzard · Russia → Government and defense-related targets (per source) per OpenAI

ReconMalware dev

ChatGPT (OpenAI services)stated by vendor

Salmon Typhoon used ChatGPT for research, scripting and phishing content

Salmon Typhoon · China → Government and defense-related targets (per source) per OpenAI

ReconMalware devEvasion

ChatGPT (OpenAI services)stated by vendor

Arup employee tricked by deepfake video call into $25M transfers

unknown → Arup (engineering), Hong Kong office per CNN Business

DeepfakeFraudSocial engineering

unspecified voice-clone/deepfake toolunknown

Retool breached via SMS phishing and deepfaked employee voice

unknown → Retool (software), crypto customers per Retool

Social engineeringDeepfake

unspecified voice-clone/deepfake toolstated by victim

No incidents match these filters.