- Palo Alto Networks' Unit 42 reports one actor used jailbroken AI assistants to attack Indian universities and plan fraud, taking more than 5,200 records from one.
- Unit 42 says AI lowered the skill barrier: one person worked across attack types that normally need different specialists.
- Leaders should check admin password strength, leaked usernames and who can read their databases, because AI-guided attackers still use common weaknesses.
The expert was a chat window
For years, cybercrime had a built-in brake. Each kind of fraud or intrusion needed a different specialist, and specialists were scarce. A report from Palo Alto Networks' Unit 42 describes what happens when that brake is removed. One actor, using the handle BUGSTER, asked AI assistants for the expertise instead of learning it.
The lesson here is that the scarce thing in cybercrime was never the tools. It was know-how. AI now lets a person rent that know-how by conversation. Defenders can no longer assume a modest attacker is a weak one.
What Unit 42 found
Unit 42 investigated the actor's operating environment. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine. Cursor, a code-writing tool, served as a secondary tool. Safety controls were disabled on both.
The actor tested other models, including GLM 5.2, and built a script to send a safety override and flag refusals. Unit 42 calls this evidence of resistance the actor worked to overcome. The actor settled on DeepSeek V4. Unit 42 says the override was a simple system-prompt instruction.
Unit 42 says the targets were mainly in India. It calls the actor financially motivated, with no prior reporting. It says the tooling was basic and the impact was still real.
How the university attack worked
The first target was an Indian university's online education platform. Unit 42 says the attack ran in four stages, and the reports the actor kept looked AI-written, with executive summaries and severity ratings.
First, the actor found 12 subdomains, including the main WordPress site, a learning system, a student portal and an admin dashboard. Second, the actor pulled 13 active user IDs with real names from post author fields and author sitemaps. Cloudflare's web application firewall blocked direct requests to the user list. The sitemaps gave up the same names anyway.
Third, a generator script built a guessing tool with 117 usernames and 28 common passwords. Fourth, the tool flagged one valid login. It was an administrator account with a weak password.
This was a configuration and password failure. Unit 42 does not describe a software flaw. A firewall that guards one door does not help if the same data leaves through another.
At a second public university, the actor exfiltrated a MongoDB database. Unit 42 says it held more than 5,200 records, including personal data on students.
Planning, not yet operating
The most telling material is about fraud. The actor built a Hermes profile called alice as an adviser on Voice over IP (internet phone) fraud. According to Unit 42, the plan was to register a US company as a front. It would then buy call capacity from carriers and mix roughly 70% legitimate traffic with 30% fraudulent calls to stay below audit thresholds.
The plan also covered getting around STIR/SHAKEN, the FCC-mandated caller identity check. Unit 42 notes the limits. It found no call logs, no SIP traces and no active call routing. It concludes the operation was in planning or early setup.
The actor also built a Wi-Fi cracking pipeline. A small Linux device captured network credentials near targets and sent them to rented cloud GPUs. Unit 42 says this needs physical proximity, so the actor had local access. The actor also collected data on 45 cryptocurrency large holders. Unit 42 says it likely supports future targeting, and it saw no follow-on activity.
One case, with a pattern Unit 42 flags
This is a single actor, and the findings should be read that way. Unit 42 does say that multiple, unrelated actors are adopting the same Hermes and DeepSeek pairing. It assesses that low cost, easy access and simple jailbreaking drive this. That is Unit 42's assessment, not a measured trend across all criminals.
Questions to put to your team
Start with the weakest link in this case. Does every administrator account on your public sites use a strong, unique password and a second login factor? Can anyone list your staff or student names through author pages, sitemaps or similar routes?
Next, ask whether repeated failed logins trigger a block or an alert. Here, 117 usernames and 28 passwords produced a hit. Then ask who can reach your databases from outside, and whether you would notice a large export.
Finally, assume the person probing you has a patient adviser. The attacker's skill is no longer the limit. Basic hygiene is what stands between a bored amateur and your data.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks Unit 42.
