Artificial intelligence is entering a dangerous new phase of cybercrime, where autonomous AI agents are moving beyond phishing and malware development to actively orchestrating attacks against enterprise networks.
Researchers have uncovered real-world attacks involving CyberStrikeAI, an open-source penetration-testing framework weaponised against educational institutions across Africa and Latin America.
The investigation, published on November 2, 2026, reveals how attackers combined large language models with command-and-control infrastructure to automate complex post-compromise operations.
Unlike conventional malware, CyberStrikeAI separates decision-making from execution. A server-based AI orchestrator selects tools, generates commands and interprets results, while compromised endpoints execute instructions.
Researchers observed attackers initially exploiting compromised SQL Server environments before deploying AI-controlled implants capable of reconnaissance, persistence, credential theft and lateral movement.
In one incident, attackers reportedly compromised highly privileged domain administrator accounts within three to four days. Subsequent credential harvesting, network movement and database extraction occurred within approximately one hour.
The framework also generated customised PowerShell scripts, executed suspicious scheduled tasks and leveraged legitimate Windows utilities, complicating detection through conventional signature-based security controls.
More concerning is the changing economics of cybercrime. AI orchestration could reduce dependence on highly skilled operators, accelerate attack execution and enable adversaries to coordinate multiple intrusions simultaneously.
Although researchers identified Chinese-language artifacts, Kaspersky could not conclusively attribute the campaign to any known threat group. The investigation demonstrates operational AI-assisted attacks, not completely independent criminal intelligence.
The cybersecurity industry must now prepare for machine-speed adversaries. Enterprises need continuous behavioural monitoring, identity protection, endpoint detection, network segmentation and automated containment. As attackers delegate tactical decisions to AI, defensive systems must combine intelligent detection with enforceable security controls and human oversight.
