Chinese‑linked Hackers Deploy Commercial AI Tools to Automate Multi‑Nation Attacks

Threat‑intelligence firm Hunt.io has identified a new wave of cyber activity originating from actors speaking Mandarin that are leveraging commercial artificial‑intelligence agents to conduct automated intrusions across government, academic and industrial networks in several Asian countries.

The campaign, described by Hunt.io as distinct from earlier China‑associated operations, integrates off‑the‑shelf AI models directly into the attackers' tooling. By feeding these models with command‑and‑control instructions, the group can generate phishing content, craft exploit code and adapt tactics in real time without manual oversight.

Targets span ministries, universities and manufacturing firms, all of which hold data that can be valuable for espionage or economic gain. The use of AI agents allows the perpetrators to scale attacks quickly, tailoring malicious payloads to specific organizations’ software stacks and security postures, a capability that previously required larger, more resource‑intensive teams.

Security analysts note that the approach reflects a broader trend where state‑aligned threat groups adopt commercially available AI services to augment their arsenals. While the underlying AI platforms are marketed for legitimate purposes, their accessibility lowers the barrier for sophisticated automation, blurring the line between traditional hacking groups and “AI‑as‑a‑service” operators.

Defenders are urged to update detection rules to account for AI‑generated content, monitor anomalous usage of cloud‑based AI APIs, and reinforce user awareness programs that address increasingly convincing phishing attempts. Governments in the region have begun reviewing their cyber‑defense policies to incorporate AI‑focused threat modeling.

Hunt.io’s findings underscore the evolving risk landscape as artificial intelligence becomes an integral component of cyber‑espionage. Continued collaboration between private security firms, academic researchers and national agencies will be essential to track these developments and mitigate the potential fallout from AI‑enabled intrusion campaigns.