Chinese speaking Hackers Deploy 44 AI Agents to Target

What happened

In October 2026, security researchers identified a cyber attack campaign where a Chinese-speaking threat actor utilized the CyberStrikeAI framework to automate malicious operations. This framework enabled the deployment of 44 autonomous AI agents, which were tasked with executing a full attack lifecycle against at least 19 organizations, with at least 16 of those targets located in Japan.

The agents functioned as part of a repeatable, structured workflow rather than through ad hoc manual intervention. The platform automated several critical stages of the attack, including initial reconnaissance, vulnerability discovery and validation, exploitation, command-and-control (C2) establishment, persistence, and data exfiltration. Additionally, the system generated automated reports for each target in a consistent format. The AI agents also demonstrated the capability to generate fake login pages and forms specifically in the Japanese language, likely to facilitate credential harvesting or social engineering efforts.

Trend Micro’s enterprise security division noted that the activity was concentrated within a short period in October 2026. While the primary focus of this specific campaign was on Japanese organizations, the researchers indicated that the threat actor behind this case has also targeted entities in Taiwan and Hong Kong. There is currently no evidence to suggest that this incident is linked to other AI-driven campaigns documented during the same timeframe, and the specific AI models powering the CyberStrikeAI framework remain unknown. The incident highlights a broader trend where threat actors are integrating agentic AI into offensive workflows to increase the speed, scale, and autonomy of their operations, effectively industrializing reconnaissance and exploitation processes.