Unit 42 Finds Hacker Used AI to Attack Indian Universities

Unit 42, the threat research team at Palo Alto Networks, detailed in a research post how a hacker used AI tools to plan and conduct several types of cybercrime. The actor used the Hermes Agent framework with DeepSeek V4 and Cursor, with safety controls disabled.

The actor used AI generated reconnaissance and scripts to target an Indian university. The campaign identified subdomains and user accounts, generated a brute force tool with 117 usernames and 28 common passwords, and flagged one WordPress login as valid.

At a second Indian public university, the actor obtained an administrator account and extracted a MongoDB database containing more than 5,200 student and faculty records. Unit 42 also found that the actor used specialized AI bot profiles to research VoIP fraud, WiFi password cracking and large cryptocurrency holders, although the VoIP operation appeared to remain in an early setup phase.