AI attacks this week
Every week we round up reported attacks in which AI was essential: as a tool, as a target or for deception. For each case we say how well established the information is. Each issue ends with the steps we recommend.
All issues
Arrest in Seoul after break-ins at about 60 companies using AI
Police in Seoul have arrested a suspected hacker who allegedly broke into about 60 companies in 44 days using the AI attack tool ARTEX. This week CrowdStrike, Google and the registrar 123 Reg reported the same tool being used in espionage, extortion and data theft. Also: more break-ins at platforms for AI developers and a tampered Claude Code extension.
State-aligned group uses AI agents to attack through ConnectWise
According to Microsoft, a China-state aligned group automated its attack on ConnectWise with the AI tool ARTEX and then went after more than 2,250 Microsoft 365 tenants. Also this week: breaches at platforms that were about keys for AI services, and AI agents that broke into the websites of more than 100 companies.
India's CERT-In lists AI agents as attackers
India's cyber security agency CERT-In describes incidents in which an AI agent was the attacker, and calls the weaknesses exploited conventional. Also this week: a breach at the coding service OpenCode, signs of AI-generated scripts in an espionage campaign and new official figures from South Korea.
An agentic pentesting tool used against banks in South Korea
CrowdStrike documents intrusions at South Korean financial organisations, run with an agentic pentesting tool and Claude Code. Also this week: a botnet on exposed AI servers, a worm in an AI SDK and a sentence for streaming fraud with AI-generated music.
DIVD sees indications of an AI agent in its breach
The Dutch DIVD attributes a breach of its systems, based on its own analysis, to an AI agent. Also this week: reports of voice cloning in scam calls in Australia, Custom GPTs used as lures and two flaws in AI tools for enterprises.