Chinese Hackers Weaponize AI Tools in Cyber Espionage Campaign

Chinese-linked threat actors have integrated Anthropic's Claude Code and DeepSeek-v4-pro into a cyber espionage campaign targeting government entities and financial organizations in Taiwan. The operation utilizes TencShell command-and-control infrastructure, which was previously documented by Cato CTRL in May 2026. Researchers from Hunt have confirmed that these AI tools are embedded within the core execution flows of the attacks, indicating a sophisticated level of integration. The campaign is currently active, posing significant risks to the targeted sectors. The specific vulnerabilities exploited and the number of affected organizations remain unspecified, but the implications for national security and economic stability are considerable.

Key Points: • Chinese hackers are using AI tools Claude Code and DeepSeek in cyber espionage. • The campaign targets Taiwanese government and financial sectors. • TencShell C2 infrastructure is linked to the ongoing attacks.