Jailbroken DeepSeek V4 Helped Hacker Steal 5,200+ Indian University Records in AI-Powered Cyberattack

Unit 42 says a financially motivated hacker used a jailbroken DeepSeek V4 AI model to run an AI-assisted cyberattack against Indian universities, stealing more than 5,200 student and faculty records. The investigation describes how “BUGSTER” configured the Hermes Agent framework with DeepSeek V4 as its reasoning engine and used Cursor IDE as an additional AI development tool, while disabling or bypassing safety controls. The attacker automated multiple crimes, including credential theft, data exfiltration, VoIP fraud, Wi-Fi password cracking, and cryptocurrency reconnaissance. Unit 42 found the hacker used AI-generated reconnaissance to map subdomains, extract user information, and develop tools for credential attacks, including obtaining valid credentials in one campaign. In another incident, the actor exfiltrated a MongoDB database via a weak administrator password.