Attackers turn to AI for help identifying files worth stealing

Gambit Security examined three unrelated AI-assisted cyber operations: a ransomware operator using Claude Code to perform reconnaissance, exploitation and data exfiltration across multiple organizations (including an Australian energy utility); Zerofot, which used AI-built tooling to crawl the internet for exposed credentials and validated nearly 3,000 keys from 1,742 hosts; and RAGE, a Python attack framework largely generated by AI that exploits internet-facing services to harvest credentials and deploy cryptocurrency miners, with an AI orchestrator advising operators at runtime.