Security researchers have identified a sophisticated campaign where a China-based threat actor leveraged the DeepSeek AI platform to execute illicit operations. According to Dark Reading, the incident involved the deployment of the model to automate and facilitate a large-scale proxyjacking attack. In this scheme, unauthorized parties hijacked the computing resources of more than 1,200 remote hosts to serve as proxies for further malicious activity, effectively masking the true source of ongoing cyberattacks.

The investigation highlights a growing trend in the cybersecurity landscape where state-aligned or independent threat groups integrate emerging generative AI tools into their offensive playbooks. By weaponizing DeepSeek, the perpetrators were able to streamline the identification and exploitation of vulnerabilities across an extensive network of endpoints. This maneuver serves as a stark reminder that as AI technologies become more accessible and powerful, their potential for misuse by malicious entities increases, necessitating more robust automated defense systems and real-time network monitoring.

Cybersecurity experts warn that these types of AI-assisted attacks represent a significant evolution in the methodology of persistent threats. By automating the proxyjacking process, the attackers achieved a level of operational scale that would be manually labor-intensive. As investigations continue, security teams are urged to bolster their defenses against unauthorized remote access and monitor for unusual traffic patterns consistent with proxy-based infrastructure, as traditional perimeter security may no longer be sufficient to thwart AI-driven campaigns.