Hackers Use CyberStrikeAI Agents to Automate Network Scanning, Exploitation, and Data Theft

Hackers have abused CyberStrikeAI, an open-source penetration-testing platform, to coordinate 44 AI agents across network scanning, exploitation, persistence, and data theft.

The activity primarily targeted Japanese organizations, showing how attackers can turn security tools into repeatable intrusion workflows without developing new vulnerabilities or manually directing every task.

During a short period in October 2026, the platform checked weaknesses at at least 19 organizations, including 16 in Japan.

Earlier reporting on CyberStrikeAI attacks against FortiGate devices documented separate abuse of the same tool, although shared software does not establish a connection between the operators behind these campaigns.

Researchers from TrendAI, Bakuei Matsukawa and Joseph C Chen, identified the malicious activity while examining publicly accessible files on attacker-controlled servers.

Their October 27 research report distinguishes CyberStrikeAI’s autonomous workflow from two other operations using AI for planning or scripting. The platform is a legitimate testing tool, not a newly discovered malware family.

Hackers Use CyberStrikeAI Agents

The exposed CyberStrikeAI environment connected reconnaissance, vulnerability discovery, validation, exploitation, command and control, persistence, exfiltration, and reporting.

Instead of leaving an operator to move results between tools, the framework assigned work to specialized agents and recorded their findings in a database, creating a repeatable process across multiple targets.

One recovered entry, “credential-search agent 8/44,” confirmed a configuration involving 44 agents. Different agents searched for credentials, investigated vulnerabilities, attempted exploitation, and handled exfiltration.

The platform generated structured reports and produced Japanese-language forms and fake login pages, helping operators adapt their material to the organizations they targeted.

Its management dashboard displayed tool execution success rates, token usage, and batch creation controls. Each identifiable target had a consistently formatted report and an evidence index.

These records supported TrendAI’s assessment that AI drove the workflow, rather than merely helping a human operator write occasional commands or summarize results.

The same coordination model has legitimate uses: platforms such as ThreatBook’s multi-agent testing platform bring automated agents together for authorized assessments.

In the malicious CyberStrikeAI deployment, however, agents worked across organizations in parallel while limiting traffic sent to each target. That distribution made activity harder to recognize from one organization’s logs alone.

The strongest intrusion evidence began with an unauthenticated administration interface exposed on a legacy web system. No novel vulnerability was involved.

Crucially, validation activity did not mean every organization was breached: many reports explicitly recorded “no session, no web shell, no exfiltration,” and deep compromise affected only a small proportion.

What the Evidence Means for Detection and Defense

TrendAI reconstructed the activity from open directories containing scripts, target lists, logs, command histories, and attack results.

Researchers did not have victim-side logs, disk images, or network records. The findings therefore establish what attackers prepared, attempted, and recorded, but cannot independently confirm every claimed success or the full damage.

The other cases illustrate why AI involvement needs careful labeling. In one human-led operation, an LLM helped develop tools and attack plans, while the operator retained control.

Confirmed theft of property records, commercial information, Windows credentials, and email belonged to that separate case, not the CyberStrikeAI operation.

Another infrastructure showed high-confidence signs of AI-assisted scripting, but researchers lacked direct prompts or API keys confirming its use.

Comparable reporting on AI-generated Linux credential theft scripts also separates suspected code-generation assistance from autonomous execution. Neatly organized comments or emoji may support an assessment, but they do not establish that AI controlled an entire intrusion.

For defenders, the practical priorities remain familiar: inventory public-facing applications, patch or isolate legacy systems, remove unnecessary administration interfaces, and replace default credentials.

Monitoring should account for low-frequency, distributed attempts. TrendAI also recommends reviewing VPN configurations and exposed AI services, reflecting weaknesses observed across its three investigations.

The attackers’ identities, underlying AI models, and any relationship between the three infrastructures remain unresolved.

Simplified Chinese was the working language across the environments, but TrendAI cautioned that language alone cannot establish location or affiliation. Its central finding concerns scale and coordination, not proof of a new state-backed campaign.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use CyberStrikeAI Agents to Automate Network Scanning, Exploitation, and Data Theft appeared first on Cyber Security News.