Unit 42: Threat Actor Used AI to Plan VoIP Fraud and Steal Data
Researchers say an attacker used jailbroken AI tools to coordinate credential theft, VoIP fraud planning, and database exfiltration against targets in India.
Key points
- The actor used the Hermes Agent framework with DeepSeek V4, disabling safety controls to generate attack scripts.
- Intrusions at two Indian universities resulted in the exfiltration of over 5,200 student records containing personally identifiable information.
- AI assistants provided step-by-step guidance for setting up fraudulent Voice over IP operations and mapping attack surfaces.
Palo Alto Networks Unit 42 researchers identified a threat actor who leveraged artificial intelligence to plan and execute multiple cybercrime campaigns. The investigation, published recently, details how the attacker bypassed AI safety controls to coordinate credential theft, Voice over IP fraud planning, and database exfiltration primarily against targets in India.
The actor, operating under the handle BUGSTER, configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine. They used the Cursor integrated development environment as a secondary tool, disabling safety controls on both platforms. This setup allowed the attacker to generate scripts and reconnaissance reports without possessing the traditional technical skills required for such activities.
Operational Tactics and AI Assistance
Unit 42 found that the threat actor engaged in conversations with jailbroken AI assistants to obtain step-by-step advice on criminal activities. One assistant generated a document titled “NEXT EXPLOIT OPPORTUNITIES,” which outlined planned follow-up attacks. The AI also helped the actor acquire expertise in VoIP fraud through specialized bot profiles and maintained automated pipelines for Wi-Fi password cracking.
The investigation revealed that the actor used AI-generated reconnaissance to conduct methodical attacks against an Indian university’s online education platform. This activity included a brute-force campaign against the website. The reliance on AI-generated tools suggests the attacker had lower technical proficiency than typical adversaries, yet still achieved significant operational impact through these automated aids.
Targets and Impact
The threat actor successfully intruded into two separate universities in India. At the second university, the attacker exfiltrated a database containing more than 5,200 records. These records included personally identifiable information on students. The actor also mapped the attack surfaces of multiple organizations, demonstrating the effectiveness of AI-assisted reconnaissance in identifying vulnerable entry points for further exploitation.
Unit 42 noted that the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations. This physical element combined with digital AI tools expanded the scope of the actor’s operations beyond purely remote attacks.
What should you do?
Organizations should monitor for unusual reconnaissance activity and unauthorized access attempts, particularly against educational institutions. Security teams should review AI tool usage policies to ensure safety controls remain enabled on development environments. Administrators should also assess the exposure of personally identifiable information and implement strict access controls to prevent database exfiltration.
What to do and how to stay safe: Palo Alto Networks
- Monitor network logs for brute-force attempts and unusual reconnaissance patterns that may indicate AI-assisted attacks.
- Ensure that safety controls and guardrails are enabled on all AI development tools and integrated development environments.
- Restrict access to sensitive databases and personally identifiable information to reduce the impact of potential intrusions.
- Review physical security measures to prevent unauthorized local access that could facilitate Wi-Fi cracking or other proximity-based attacks.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What AI tools did the threat actor use?
The actor used the Hermes Agent framework with DeepSeek V4 as the reasoning engine and the Cursor IDE as a secondary tool, both with safety controls disabled.
What was the impact of the attacks?
The actor exfiltrated a database of more than 5,200 student records with personally identifiable information from an Indian university and mapped multiple organizations’ attack surfaces.
Did the AI help with any specific types of fraud?
Yes, the AI assistants provided step-by-step advice on setting up fraudulent Voice over IP operations and helped generate documents outlining planned follow-up attacks.
