Indian Universities Breached by Jailbroken AI, Exposing 5,200 Student Records and VoIP Schemes

A threat actor operating under the handle BUGSTER used artificial intelligence to coordinate credential theft, database exfiltration, and Voice over IP fraud planning. According to research published by Palo Alto Networks Unit 42, the attacker targeted organizations in India, including universities, and successfully breached at least two educational institutions. The investigation reveals how readily available AI tools lower the barrier for executing complex cybercrime campaigns that previously required advanced technical skills.

How did the attacker use AI in this campaign?

The attacker configured the Hermes Agent framework using DeepSeek V4 as the reasoning engine and the Cursor integrated development environment as a secondary tool. Unit 42 reported that the actor disabled safety controls on both platforms to bypass restrictions. The threat actor engaged in conversations with jailbroken AI assistants to receive step-by-step advice on planning cybercrime activities. This included requests for information on past scams, such as call spoofing, and guidance on establishing fraudulent VoIP operations.

What specific damages resulted from these attacks?

The actor executed an AI-generated brute-force campaign against an Indian university’s online education platform, leading to credential theft. Unit 42 confirmed a successful intrusion into a second university, where the attacker exfiltrated a database containing more than 5,200 records. These records included personally identifiable information on students. Additionally, the threat actor mapped the attack surfaces of multiple organizations, identifying potential targets for future exploitation. The AI assistant even generated a document outlining "NEXT EXPLOIT OPPORTUNITIES" for follow-up attacks.

What other criminal activities did the actor pursue?

Beyond the university breaches, the actor built specialized AI bot profiles to acquire expertise in VoIP fraud through conversational learning. Unit 42 noted the creation of automated pipelines for Wi-Fi password cracking and cryptocurrency whale reconnaissance, which involves identifying large cryptocurrency holders. The Wi-Fi cracking capability requires close physical proximity to the target, suggesting the actor had local access to the targeted locations. This indicates a multi-vector approach to cybercrime, leveraging AI for both digital and physical-adjacent attacks.

What does this mean for threat actor toolchains?

Unit 42 observed that multiple, unrelated actors are independently adopting the same combination of Hermes and DeepSeek. This suggests an increasingly prevalent toolchain for cybercriminals seeking AI-enabled capabilities. The primary driver appears to be low safety friction and low cost, as DeepSeek models are inexpensive and easy to access. They can be readily jailbroken with a simple system-prompt override, allowing actors with limited skills to execute sophisticated campaigns that would have required significant expertise before the advent of these AI tools.

What analysts watch for

Teams usually monitor for unusual AI service configurations, such as disabled safety controls or jailbroken models, which indicate malicious intent. Analysts examine network traffic for signs of automated reconnaissance and brute-force attacks originating from internal systems. They check for data exfiltration patterns, particularly large transfers of personally identifiable information, and look for unauthorized access to educational or corporate databases. Investigating logs for the use of specific AI frameworks and IDEs can help identify compromised environments.

Background: Data exfiltration

Data leakage is the unintended exposure of information, often through misconfiguration or human error. Data exfiltration is the intentional, unauthorized transfer of data by an attacker. You must treat leakage as a hygiene problem and exfiltration as an adversarial threat. Both require distinct detection strategies and response protocols to secure your environment effectively.

Read the full guide: Data Leakage vs Data Exfiltration: Difference, Detection and Prevention

What to do and how to stay safe: Unit 42

• Review configurations of AI tools and integrated development environments to ensure safety controls are enabled and cannot be bypassed by simple prompt overrides.
• Monitor network logs for signs of automated brute-force attempts and unusual data transfers, particularly those involving personally identifiable information.
• Implement strict access controls and authentication mechanisms for sensitive databases and online education platforms to prevent credential theft.
• Educate staff on the risks of using jailbroken AI assistants and the potential for these tools to generate malicious scripts or attack plans.

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which AI tools did the threat actor use?

The actor used the Hermes Agent framework with DeepSeek V4 as the reasoning engine and the Cursor integrated development environment.

How many records were stolen from the university?

The attacker exfiltrated a database containing more than 5,200 records with personally identifiable information on students.

Did the attacker use AI for VoIP fraud?

Yes, the actor used AI assistants to get step-by-step advice on setting up a fraudulent Voice over IP operation.