“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

Cisco Talos researchers analyzed how adversaries are weaponizing AI across multiple attack vectors, including malicious software development, criminal force multiplication, and vulnerability research. Threat actors with varying skill levels are using AI to create DDoS tools, bulk-email validation platforms, credential harvesters, and cryptojacking fleets, often bypassing model guardrails through simple evasion techniques like ownership claims or CTF labeling. A francophone actor developed an automated 'Token Pipeline' to exploit React2Shell vulnerabilities and harvest credentials from exposed Git configurations, while a Turkish-speaking actor leveraged AI to manage a Monero-mining operation via compromised torrent clients. Spanish and Russian-speaking actors used AI to conduct autonomous pentesting, build scam chatbots, and target Telegram Mini Apps for cryptocurrency theft.

AI-extracted · verify before operational use