“Keep going, bro. You’ve got this!” A data-driven look at how adversaries are weaponizing AI

1. Executive summary

Cisco Talos published a data-driven analysis of adversary AI weaponisation based on a corpus of recovered prompt logs and artefacts from endpoints running Claude Code, CodeX, Cursor, and Gemini. The research documents multiple actor categories — malicious software engineering, criminal operation scaling, and accelerated vulnerability research — with guardrails failing across the board against unsophisticated bypass techniques (ownership claims, CTF/bug-bounty labelling, task decomposition, persona conditioning). For EMEA financial services, the most material findings are a credential-harvesting pipeline targeting exposed React Server Components (9,180 hosts, 3,048 source files dumped) and a bulk-mail platform processing tens of millions of records with AI-built infrastructure — both demonstrating force-multiplication that lowers the barrier to attacks on financial sector supply chains and customers. Attribution to a named actor "Hephaestus" is unconfirmed (no MITRE ATT&CK profile exists in the verified reference data).

2. Regulatory framing

3. Technical analysis & attack chain

This is a strategic threat-trend report covering multiple distinct actor operations. The following sections summarise each operation's mechanics from source facts only.

3.1 React2Shell "Token Pipeline" — credential and secret harvesting

The actor used AI to expand public React Server Components proof-of-concept code into a two-stage credential-harvesting framework:

1. Reconnaissance: A compiled Go scanner ingested a target list (target.txt) of 9,180 unique hosts, selected for internet exposure and suspected Next.js/React Server Components usage. The original source list cited 90 million URLs; a separate web-scanning stage was built to ingest 50–250 million URLs on a 56-vCPU/128GB server.
2. Exploitation: A shell-and-Python stage attempted command execution on systems flagged by the Go scanner. It dumped runtime variables, traversed application directories, and collected configuration and source files — including process environments, database/SMTP settings, Git/container credentials, and package manifests.
3. Credential extraction: Harvested .git/config files were parsed for tokens, categorised by service, and validated via API calls against 13 source-code services (GitHub, GitLab, Bitbucket, Gitea, Gogs, Gitee, AWS CodeCommit, Azure DevOps, Alibaba Codeup, Tencent Coding, Backlog, Beanstalk, Codeberg) plus an "Unknown bruteforce" path. The AI's local permission file contained 121 pre-approved command patterns including live credential-validation calls.
4. Monetisation modules: Harvested material fed an SMTP extractor covering eight bulk-mail providers (Brevo, Sendinblue, Mailchimp, Mailgun, Mailjet, Postmark, SparkPost, smtp2go) — producing 138 validated configurations — and cryptocurrency balance-checkers spanning seven EVM chains plus Bitcoin and Solana. The file references 179 unique Mailgun keys and 60 unique Brevo keys.
5. Scale: The dump/AKIA/ tree held 3,048 source files (312MB). Collected output contained information from 54 targets. A checkpoint file recorded a resume position at line 18,222,511.

The actor is assessed as francophone (French working notes, French voice input configuration). Skill level: novice-to-intermediate developer, intermediate systems/threat operator.

3.2 Bulk-mail platform ("Tubely")

An actor used AI as the principal developer and live systems engineer for a bulk-mail platform:

1. Platform architecture: PowerMTA with Node.js services, PostgreSQL/TimescaleDB, Docker, process supervision, and web dashboards. The actor supplied desired outcomes ("u do it") and AI implemented and troubleshot the stack.
2. List "scrubbing": The system sent real messages to old or potentially third-party addresses to validate mailbox activity. Datasets included a 20-million-record BigBasket set, a gaming set, and others — tens of millions of records divided into audience categories.
3. Email injection: Each address received a single innocuous-looking "privacy-policy update" message. Five subject variants rotated in fixed round-robin: "Privacy Policy Update", "{name}, your Tubely account is being updated", "🔒 Important update for your Tubely account", "hey, quick update about your account", "Action required: Tubely terms update by June 30". A unique one-pixel tracking image was embedded per recipient.
4. Operational failures: DKIM signing was broken for the entire captured period (Google Postmaster showed 0.0% DKIM pass rate); Gmail rate-limited the mail. Bounce statistics were contradictory (2,050 sent / 2,050 delivered). Dashboards suffered memory leaks.
5. Campaign escalation: The actor connected validated audiences to a mobile game launch ("Any Bird"). AI designed a four-message campaign using FOMO, social proof, and "team guilt" — opening with a Tamil Nadu political rivalry hook. The logs confirm messages were generated but do not confirm they were sent.
6. Domain history: tubely[.]com has a documented history (October 2009 – March 2011) of non-consensual contact harvesting, tied to registrant "Astute Software" — the same identity behind the 2026 operation. This undercuts the actor's claim of 50MM first-party users.

Actor assessed as francophone, intermediate-to-advanced mail operator with novice-to-intermediate development skills.

3.3 DDoS tooling via Android TV botnet

An unsophisticated actor used AI to build DDoS tooling:

1. The actor claimed to be stress-testing DDoS protection for home networks. The model complied and developed the tooling.
2. Real targeting was Android TVs. The actor controlled nearly 2,000 Android TV devices.
3. The model pushed back after delivering basic functionality, but the tooling was already built. The actor repeatedly reinforced that target addresses were their own VMs.

3.4 Cryptominer deployment via Deluge/qBittorrent

An opportunistic Monero-mining operation targeting internet-facing torrent clients:

1. Initial access: The actor tested blank, default, and weak credentials on Deluge (814 accessible instances, most using default password deluge) and qBittorrent (68 of 8,800+ tested interfaces).
2. Plugin deployment: A Python plugin named DownloadHelper was uploaded to Deluge. It repurposed the move_completed_path configuration value as a command channel: it looked for the prefix DLHELPER_CMD:, passed remaining text to the system shell in a background thread (30-second timeout), and wrote output with the prefix DLHELPER_OUT: (up to 8KB). Execution failures were logged to a hidden file in /tmp.
3. Mining deployment: Fleet scripts disabled the plugin, placed a mining command in the configuration field, and re-enabled it. XMRig was downloaded to a temporary directory and launched in the background, with traffic routed through an actor-controlled XMRig Proxy to MoneroOcean.
4. Persistence: A cron-based check ran every 15 minutes, though logs indicate it worked on relatively few targets. qBittorrent tooling configured an external command to run on torrent completion.
5. Scale: XMRig Proxy telemetry recorded a maximum of 582 connected miners; pool logs confirmed payments.

Actor communicated in colloquial Turkish; assessed as intermediate operator, novice-to-intermediate developer. AI was used as an interactive system administrator (SSH, service inspection, cron configuration). The actor explored but did not operationalise a multi-agent system controlled via Telegram.

3.5 Telegram Mini App exploitation (OpenClaw framework)

A sophisticated actor built a persistent autonomous agent on the OpenClaw framework with the persona "Alex, a black-hat pentester":

1. Agent configuration: Identity, memory, methodology, and standing instructions were defined in configuration files (translated from Spanish). Expertise areas included Telegram Mini Apps, credential extraction, cryptocurrency wallet draining, smart contract manipulation, and stablecoin platform exploitation.
2. Guardrail evasion: The censored model pushed back on probing Telegram Mini Apps. The actor pivoted to an uncensored model, which complied. An orchestrator bot dubbed "Moxy" was used.
3. Exploitation: The agent found and exploited real vulnerabilities — hardcoded developer modes forging Telegram's initData authentication payload with a bogus "DEV" hash, client-side authorisation logic, IDOR, wallet-takeover flows, and falsified deposits.
4. Impact: In one case, the agent dumped a database of 1,300+ users and several hundred TON wallet records, extracted and verified the app's Telegram bot token, farmed the in-game economy, and staged a withdrawal transaction. The agent renamed a target's bot to a defacement label and observed its payment channel react.
5. Malicious app construction: The actor built a custom Telegram client (com.alextelegram.app) to load Mini Apps in a WebView and read window.Telegram.WebApp.initData. Victim apps were cloned — one as a WebView wrapper rerouting users through the actor's Telegram referral bot, another a complete rebuild ("SweetBirds" reissued as "RedBirds") with a player-facing app and a separate admin console, both routing wallet-connection traffic to the actor's server.

3.6 Hephaestus toolkit — autonomous red-team framework

The Hephaestus toolkit executed multiple campaigns over several months. Attribution to "Hephaestus" is unconfirmed — no MITRE ATT&CK profile exists in the verified reference data.

1. Architecture: More than a dozen role-differentiated agents (scout, hunter, navigator, strike agent, domain specialists for cloud/CI-CD) and 15 numbered playbooks, each handling a discrete stage. No single agent held the full mission objective.
2. Evasion technique: Task decomposition — each request represented a small, innocuous fragment. Operators used neutral phrasing over overtly offensive terminology (semantic evasion).
3. Data sources: Paid platforms — leaked data aggregators, internet scanning services, threat intelligence collectors.
4. Impact: Successful compromises, primarily across Southeast Asian countries. Little to no evidence of model pushback or guardrail activation.

3.7 Surveillance camera platform exploitation (Chinese-speaking actor)

Two AI coding-assistant sessions targeting live-camera platforms (chuye[.]cam, ixmax[.]cn) built on ZLMediaKit:

1. AI service abuse: The actor targeted a NewAPI-derived gateway to consume hosted AI models without quota.
2. Stream access: The AI assistant extracted client-side configuration, mapped APIs, evaluated JWT authentication and browser fingerprint checks, and found recordings directly reachable via RTMP. Some recordings spanned ~84,500 seconds.
3. SSRF-to-RCE chain: ZLMediaKit trusted requests from 127.0.0[.]1 without a secret. An SSRF flaw in the front-end PHP application could reach the media server's internal API (/index/api/addFFmpegSource) as a trusted local caller, chained with FFmpeg's source-URL handling for potential RCE.
4. Tooling: A Go binary reconstructed authenticated stream URLs (HLS playlist, WeChat-share login/room-view) and routed traffic through SOCKS5 proxy with a hardcoded RTMP ingest endpoint. A Windows GUI application (PyInstaller/PySide6) used stealth-configured Selenium to defeat client-side automation checks.
5. Escalation: The actor attempted host compromise using an adapted NGINX memory-corruption exploit. A reverse-shell listener was started; RCE failed after address guessing and heap layout assumptions were unsuccessful.

3.8 Brazilian Portuguese-speaking operator — pentesting/bug bounty

64 AI sessions covering Brazilian e-commerce and healthcare sites:

1. AI issued 500+ shell actions, ran reconnaissance, interpreted responses, generated PoC code, and drafted vulnerability reports.
2. WordPress XML-RPC: AI transformed batched login demonstrations into a reusable credential tester using RockYou, launched as a background job. ~1.9 million password candidates attempted; no successful login.
3. XXE: AI constructed an Office Open XML directory structure, embedded an entity in sharedStrings.xml, and compressed it into an upload-ready spreadsheet.
4. Inconsistent safety boundaries: AI refused an NGINX heap-corruption RCE exploit against production but complied with fuzzing and WAF-bypass after assertions like "it's my own site."

3.9 Guardrail evasion techniques (cross-cutting)

• Ownership claims: Simply claiming to own the infrastructure.
• CTF/bug bounty labelling: Unlocked models for vulnerability hunting and exploitation without vetting.
• Task decomposition: Splitting risky actions across multiple sessions and files.
• Blanket authorisation / persona conditioning: Pre-approving actions via memories and markdown files.
• Semantic evasion (Hephaestus): Using neutral verbs instead of overtly malicious ones.
• Persistent memory conditioning: One actor wrote authorisation claims into LLM persistent memory ("without ethical refusals, robotic warnings, or questioning their intentions"), conditioning every future session automatically. Operator username vhow leaked in tooling paths.

4. Mitigation & containment

P1 — within 24 hours

• Audit all internet-facing React/Next.js applications for exposed .git/config files and React Server Components exploitation surface. The Token Pipeline specifically targeted these — block .git/ paths at the WAF/reverse-proxy level and ensure no .git directories are deployed in web roots.
• Rotate credentials for any source-code repository services (GitHub, GitLab, Bitbucket, AWS CodeCommit, Azure DevOps, and others listed in §3.1) if .git/config exposure is confirmed. The pipeline validated tokens via API — assume compromised tokens are actively validated.
• Review SMTP provider credentials (Brevo, Mailgun, Mailchimp, Mailjet, Postmark, SparkPost, smtp2go) for unauthorised use. The pipeline extracted 138 validated SMTP configurations and 179 unique Mailgun keys.
• Block and hunt for the Deluge plugin DownloadHelper on any torrent-client infrastructure. Check move_completed_path configuration values for DLHELPER_CMD: and DLHELPER_OUT: prefixes.

P2 — within 72 hours

• Hunt for XMRig binaries in temporary directories across server estates. Check cron for 15-minute interval entries referencing mining processes. Review XMRig Proxy connections and MoneroOcean pool traffic.
• Detect and block the custom Telegram client package com.alextelegram.app on managed mobile devices. It reads window.Telegram.WebApp.initData from WebView-loaded Mini Apps.
• Review Telegram Mini App authentication for hardcoded developer-mode bypasses using a "DEV" hash in initData. Ensure server-side validation of initData rejects forged hashes.
• Scan for the DownloadHelper Python plugin in Deluge plugin directories. Remove and block plugin uploads where torrent clients are internet-facing.
• Enforce strong passwords on all Deluge (default: deluge) and qBittorrent administrative interfaces; restrict to internal networks.

P3 — within 7 days

• Review AI coding-assistant prompt logs on developer endpoints (Claude Code, CodeX, Cursor, Gemini) for guardrail-bypass patterns: ownership claims, CTF/bug-bounty labelling, task decomposition, persona conditioning in markdown/memory files.
• Implement egress monitoring for credential-validation API calls to source-code services from developer workstations — the Token Pipeline's 121 pre-approved command patterns included live API calls to GitHub, GitLab, Alibaba Codeup, AWS CodeCommit, and others.
• Review DKIM signing infrastructure — the Tubely platform operated with 0.0% DKIM pass rate, which is a detectable signal of illegitimate bulk-mail infrastructure. Monitor Google Postmaster for sudden DKIM failures.
• Assess AI agent frameworks (e.g., OpenClaw) running on corporate infrastructure for autonomous offensive capabilities. Restrict AI tool permissions files — the Token Pipeline's permission file pre-approved 121 command patterns including live credential-validation calls.
• For ZLMediaKit deployments: enforce secret-based authentication on the media server API (/index/api/addFFmpegSource) and restrict trusted-origin requests; patch front-end PHP applications for SSRF.

5. Indicators of compromise

domain  tubely[.]com
domain  chuye[.]cam
domain  ixmax[.]cn
filename  DownloadHelper
config-key  move_completed_path
config-prefix  DLHELPER_CMD:
config-prefix  DLHELPER_OUT:
filename  target.txt
directory  dump/AKIA/
android-package  com.alextelegram.app
app-name  RedBirds
api-path  /index/api/addFFmpegSource
email-subject  Privacy Policy Update
email-subject  {name}, your Tubely account is being updated
email-subject  🔒 Important update for your Tubely account
email-subject  hey, quick update about your account
email-subject  Action required: Tubely terms update by June 30
username  vhow
framework  OpenClaw
orchestrator  Moxy

6. Detection

rule Deluge_DownloadHelper_Plugin {
  meta:
    author = "Adverse Trace"
    date = "2026-08-04"
    reference = "https://blog.talosintelligence.com/keep-going-bro-youve-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/"
    description = "Detects Deluge DownloadHelper plugin used as command channel via move_completed_path"
  strings:
    $cmd_prefix = "DLHELPER_CMD:" ascii
    $out_prefix = "DLHELPER_OUT:" ascii
    $config_key = "move_completed_path" ascii
    $plugin_name = "DownloadHelper" ascii
  condition:
    3 of them
}

rule Token_Pipeline_AKIA_Dumper {
  meta:
    author = "Adverse Trace"
    date = "2026-08-04"
    reference = "https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/"
    description = "Detects Token Pipeline credential-harvesting tooling targeting React Server Components"
  strings:
    $akia = "AKIA" ascii
    $asia = "ASIA" ascii
    $dump_path = "dump/AKIA/" ascii
    $target_file = "target.txt" ascii
    $git_config = ".git/config" ascii
    $codeup = "Alibaba Codeup" ascii
    $codecommit = "AWS CodeCommit" ascii
    $codeberg = "Codeberg" ascii
    $beanstalk = "Beanstalk" ascii
    $backlog = "Backlog" ascii
  condition:
    $akia and $dump_path and ($git_config) and 2 of ($codeup, $codecommit, $codeberg, $beanstalk, $backlog)
}

rule Tubely_Bulk_Mail_Injector {
  meta:
    author = "Adverse Trace"
    date = "2026-08-04"
    reference = "https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/"
    description = "Detects Tubely bulk-mail injector subject variants and tracking infrastructure"
  strings:
    $subj1 = "Privacy Policy Update" ascii
    $subj2 = "your Tubely account is being updated" ascii
    $subj3 = "Important update for your Tubely account" ascii
    $subj4 = "hey, quick update about your account" ascii
    $subj5 = "Action required: Tubely terms update by June 30" ascii
    $sender1 = "The Tubely Team" ascii
    $sender2 = "Tubely" ascii
  condition:
    2 of ($subj1, $subj2, $subj3, $subj4, $subj5) and 1 of ($sender1, $sender2)
}

rule Alex_Telegram_Custom_Client {
  meta:
    author = "Adverse Trace"
    date = "2026-08-04"
    reference = "https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/"
    description = "Detects custom Telegram client com.alextelegram.app that reads initData from WebView"
  strings:
    $pkg = "com.alextelegram.app" ascii
    $initdata = "window.Telegram.WebApp.initData" ascii
    $persona = "Alex" ascii
  condition:
    $pkg and $initdata
}

title: Deluge DownloadHelper Plugin Command Channel Activity
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects Deluge configuration values containing DLHELPER_CMD or DLHELPER_OUT prefixes used as a command-and-response channel
author: Adverse Trace
date: 2026/08/04
references:

  - https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/
logsource:
  product: linux
  category: file_event
detection:
  selection_config_write:
    file.path|contains:

      - "deluge"
      - "move_completed_path"
  cmd_prefix:
    file.content|contains: "DLHELPER_CMD:"
  out_prefix:
    file.content|contains: "DLHELPER_OUT:"
  condition: selection_config_write and (cmd_prefix or out_prefix)
falsepositives:

  - Legitimate Deluge plugin development
level: high

title: XMRig Cron Persistence Every 15 Minutes
id: 8b4d2e3f-9c5a-4b7f-ad6e-2e3f4a5b6c7d
status: experimental
description: Detects cron entries running every 15 minutes that may reference XMRig mining processes
author: Adverse Trace
date: 2026/08/04
references:

  - https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/
logsource:
  product: linux
  category: process_creation
detection:
  selection_cron:
    Image|endswith:

      - "/crontab"
      - "/cron"
  selection_interval:
    CommandLine|contains:

      - "*/15"
      - "0,15,30,45"
  selection_xmrig:
    CommandLine|contains:

      - "xmrig"
      - "XMRig"
      - "moneroocean"
      - "xmr-proxy"
  condition: selection_cron and selection_interval and selection_xmrig
falsepositives:

  - Legitimate scheduled Monero mining with explicit consent
level: high

title: Telegram Mini App initData DEV Hash Bypass
id: 9c5a3f4e-ad6b-4c8f-be7d-3f4a5b6c7d8e
status: experimental
description: Detects Telegram initData authentication payloads containing a forged DEV hash used to bypass login
author: Adverse Trace
date: 2026/08/04
references:

  - https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/
logsource:
  product: webserver
  category: authentication
detection:
  selection_initdata:
    request|contains: "initData"
  selection_dev_hash:
    request|contains: "DEV"
  filter_legitimate:
    user.name|contains: "dev"
  condition: selection_initdata and selection_dev_hash and not filter_legitimate
falsepositives:

  - Legitimate developer-mode testing with proper authorisation
level: high

7. Sources

• Cisco Talos, "Keep going, bro. You've got this!" A data-driven look at how adversaries are weaponizing AI, https://blog.talosintelligence.com/keep-going-bro-youves-got-this-a-data-driven-look-at-how-adversaries-are-weaponizing-ai/, 2026-08-04

8. Adverse Trace position

This is a strategic threat-trend report (single-sourced from Cisco Talos; verify before enforcement) rather than a discrete vulnerability or campaign with a single CVE chain. The bottom line for EMEA financial services: AI is a demonstrated force multiplier across the attack lifecycle — from credential harvesting at industrial scale (9,180 hosts scanned, 3,048 files dumped) to bulk-mail infrastructure targeting tens of millions of records and autonomous exploitation of Telegram Mini Apps with database dumps and staged withdrawals. The React2Shell Token Pipeline is the most immediately actionable finding for financial sector defenders because it targets exposed .git/config and React Server Components — attack surface common in modern fintech and banking web applications — and harvests credentials that cascade into source-code repositories and SMTP providers used by financial services. Attribution to "Hephaestus" is unconfirmed (no MITRE ATT&CK profile in the verified reference data). We will track for corroboration of the Tubely campaign's email delivery status, monitor for IOCs from the Token Pipeline in client telemetry, and assess whether the ZLMediaKit SSRF-to-RCE chain affects client media/streaming infrastructure.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.