AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft

Threat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures.

The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts.

The research follows Japan’s National Cybersecurity Office warning on October 9, 2026, after incidents involving compromised web systems and stolen personal information.

Researchers reconstructed the operations from publicly accessible directories on attacker-controlled servers, examining scripts, command histories, target lists, logs, and retrieved data.

The infrastructures were separate from previously reported ARTEX activity and primarily targeted Japan, although other countries appeared in their records.

Case A involved confirmed abuse of CyberStrikeAI, an open-source penetration-testing platform built around AI agents.

The framework connected reconnaissance, vulnerability validation, exploitation, command and control, persistence, exfiltration, and reporting into a repeatable workflow.

One record referenced “credential-search agent 8/44,” indicating a configuration distributing work across 44 agents.

TrendAI reported that, Japan recorded more publicly disclosed cybersecurity incidents during the first nine months of 2026 than throughout 2025. That broader surge has not been conclusively linked to AI.

Japanese Companies Targeted

The platform also generated Japanese-language forms and fake login pages while throttling traffic against individual targets.

At least 19 organizations, including 16 in Japan, underwent validation activity. However, evidence of deep compromise affected only a small proportion. Multiple reports explicitly recorded no session, web shell, or exfiltration.

The clearest intrusion began through an unauthenticated administration interface, not a novel vulnerability.

Case B remained human-directed, with confirmed AI assistance supporting planning and tool development. An LLM-generated attack plan covered AI and GPU services, while requests framed malicious activity as authorized security testing.

The operator scanned at least 6,000 Japanese IP addresses but concentrated attacks on relatively few companies.

At one business, evidence showed control spanning FTP, databases, administrator privileges, a web shell, and SSH, with backdoors repeatedly restored after cleanup.

Another intrusion exploited default credentials on a geographic information system server.

Retrieved material and download records supported theft involving several hundred thousand cadastral and commercial records, Windows credentials, and email.

The infrastructure also contained mechanisms intended to appropriate access to AI services, suggesting an effort to obtain inexpensive inference capacity. Researchers found no evidence that AI autonomously executed this operation.

Case C targeted exposed VPN devices and Oracle WebLogic servers, with at least 1,300 WebLogic candidates and 35 VPN entry points identified.

Targets included Cisco SD-WAN, Citrix NetScaler, F5 BIG-IP, and Yamaha RTX1210 devices. Crucially, RTX1210 access relied on credentials recovered from configuration files rather than a product vulnerability.

Organized comments, section headings, and emoji-based script markers supported high-confidence AI assistance, but no prompts or API keys directly confirmed it.

Simplified Chinese appeared across all three infrastructures, without establishing nationality or shared attribution.

The central distinction is automation, not a demonstrated dependence on zero-days. Attacker-side records cannot establish every claimed compromise or the complete victim impact.

Japan’s advisory recommends prompt patching, multifactor authentication, restricted privileges, and stronger monitoring.

Related TrendAI hardening guidance recommends preventing uploaded files from executing, restricting application-code writes, and monitoring database access controls directly relevant to the observed intrusion paths.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.