Hackers have used commercial AI models to help break into government, transport and financial networks across Latin America.

The activity shows how chat-based tools can speed up familiar intrusion work, from fixing faulty scripts to moving stolen information out of a compromised system.

The campaigns did not rely on a new AI-built malware family alone. One operation abused legitimate Windows utilities and repeated batch scripts, while another used job-themed phishing, remote-access malware and a proxy tool to reach targets in Brazil’s financial sector.

Unit 42 analysts identified the two clusters as CL-CRI-1131 and CL-CRI-1163, linking them through overlapping SOCKS5 relay infrastructure and a shared pattern of using large language models during operations.

The victims included a Mexican transportation organization, federal ministries, municipal water utilities in Mexico and Ecuador, and Brazilian financial organizations.

Palo Alto Networks’ Unit 42 said in a report shared with Cyber Security News (CSN) that the impact is significant because AI appears to have reduced the time needed to troubleshoot an attack after access was gained.

Rather than replacing the attacker, the models helped operators test fixes, refine scripts and keep a multi-stage intrusion moving when earlier commands failed.

Hackers Use Claude and GPT-Powered Tools

In the Mexican campaign, operators attempted to obtain sensitive Windows data, including account and directory information.

When those attempts failed, they created volume shadow copies and used numbered batch files to copy data, changing the scripts as they worked through permissions and collection problems.

The team found an exposed, self-hosted NextChat interface on the attackers’ infrastructure. NextChat can provide one place to work with multiple models, and the surrounding activity led researchers to assess that the operators used Claude and GPT-4.1 to generate workaround code and troubleshoot execution failures.

Example of a locally hosted NextChat window (Source - Unit42) — Example of a locally hosted NextChat window (Source – Unit42)

This is a more practical threat than the idea of AI independently carrying out a breach. AI can make an operator’s trial-and-error cycle faster, especially after an initial foothold is established.

Security teams facing AI-generated phishing without malware should examine what happens after a suspicious message is opened, not only whether a file was delivered.

The operational security failures can offer defenders a way to trace and disrupt campaigns. Publicly reachable AI and staging systems gave investigators visibility into scripts, prompt history and targeting clues.

Phishing Campaign Targets Finance

The Brazilian cluster began with a resume-themed phishing attachment and then deployed custom remote-access Trojans.

The operators also tried to install multiple versions of SockTz, a Go-based reverse SOCKS5 tunneling tool, using a compromised WordPress site before switching to infrastructure they controlled.

A SOCKS5 tunnel can relay traffic through a compromised machine, helping an attacker reach internal systems while masking where commands originate.

That makes it important to investigate unusual outbound connections and proxy behavior, as GhostSocks proxy malware activity has shown how such relays can undermine anti-fraud and location-based controls.

Partial list of the campaign scripts hosted on an open directory (Source - Unit42) — Partial list of the campaign scripts hosted on an open directory (Source – Unit42)

Researchers observed versions one through nine of SockTz within roughly two hours, plus scripts carrying descriptive names and an “_output” suffix.

The rapid, repetitive naming is consistent with automated or model-assisted development, though it does not prove that every file was produced by an AI system.

Organizations should promptly patch internet-facing web servers, block or restrict exposed administrative and staging directories, and review email attachments that claim to be resumes or job documents.

They should also hunt for unexpected web shells, remote-access tools and outbound proxy traffic, while using the listed indicators to search logs and block confirmed malicious connections.

The cases underline that AI does not erase the need for basic defense. Strong patching, email filtering, network monitoring and disciplined access controls remain essential, particularly as AI agents drive cyberattacks and attackers use them to organize routine tasks at greater speed.

For defenders, the practical lesson is to follow the infrastructure as closely as the malware. Exposed servers, reusable certificates and open directories can reveal an operation’s working methods, and Kimsuky AI phishing decoys similarly show why teams need visibility into convincing lures and follow-on activity.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
IP address	`62.171.185[.]97`	CL-CRI-1131 infrastructure used for data exfiltration troubleshooting
Domain	`m-doxa-apodo.duckdns[.]org`	Mexican campaign infrastructure domain
Domain	`m-doxa-geo.duckdns[.]org`	Mexican campaign infrastructure domain
Domain	`m-doxa-intel.duckdns[.]org`	Mexican campaign infrastructure domain
Domain	`m-doxa-repuve.duckdns[.]org`	Mexican campaign infrastructure domain
Domain	`m-doxa-sre.duckdns[.]org`	Mexican campaign infrastructure domain
Domain	`m-doxa-vacunas.duckdns[.]org`	Mexican campaign infrastructure domain
IP address	`165.22.184[.]26`	Host associated with campaign TLS certificate
IP address	`178.128.87[.]160`	Host linked to NextChat and campaign certificate infrastructure
IP address	`167.148.195[.]53`	Open directory hosting SockTz installers and campaign scripts
Certificate SHA-256	`7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8`	Certificate fingerprint associated with `165.22.184[.]26`
Certificate SHA-256	`4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5`	Certificate fingerprint associated with `178.128.87[.]160`
Certificate SHA-256	`46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c`	Certificate fingerprint associated with `178.128.87[.]160`
File SHA-256	`a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996`	Brazilian financial campaign malware or tool hash
File SHA-256	`87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec`	Brazilian financial campaign malware or tool hash
URL	`hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe`	Download location for SockTz version 9
File name	`socktz_v8.exe`	SockTz version 8 installer observed in execution attempt
File name	`socktz_v9`	SockTz version 9 installer referenced by researchers
File name	`exploit_creative.py`	Script exposed in attacker-controlled open directory
File name	`exploit_careful.py`	Script exposed in attacker-controlled open directory
File name	`rce_focused.py`	Script exposed in attacker-controlled open directory

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks appeared first on Cyber Security News.