Chinese-Speaking Hacker’s Claude Code and DeepSeek Combo Fuels Autonomous Website Hacking Spree

A Chinese-speaking hacker used artificial intelligence agents in a campaign targeting more than 1,200 websites, with intrusions reported at sites belonging to more than 100 companies, including Deere, SharkNinja and Cummins. NorForge documented the technical activity through exposed control panels, while Reuters independently reviewed the operation to identify corporate victims.

The campaign began Sept. 25 and used Cairn, an open-source framework for coordinating AI agents. According to NorForge principal threat researcher Snorre Fagerland, the agents received brief instructions from an operator and carried out extended intrusion tasks. The records indicate substantial automation, but do not establish that every stage proceeded without human involvement.

NorForge estimated that the activity consumed about $5,000 in AI tokens, equivalent to roughly $50 per successful intrusion. Its analysis suggested about one in 10 tasks succeeded, with successful intrusions averaging 23 hours. These figures are estimates drawn from exposed project records, not audited totals.

What the Campaign Targeted and Achieved

The agents searched for ways to execute code on remote systems without authentication and attempted to install web shells through file-upload functions. These techniques can give an intruder the ability to run commands on a compromised server. However, the observed attempts do not establish what information, if any, was extracted from each affected website.

The companies described different responses. Deere said it took remediation steps and had no indication sensitive information was accessed. SharkNinja said a standalone product-support website was affected and the threat had been contained. Cummins said it was investigating a potential attack involving a third-party vendor website. Two smaller businesses also acknowledged compromises.

The available records do not establish the full extent of data extraction or whether attackers retained access after the companies responded.

Exposed Control Panels Revealed the Activity

Fagerland began finding exposed Cairn control panels around Oct. 2 and identified roughly two dozen instances he assessed as malicious. The interfaces exposed project logs, targets, progress and outcomes, allowing researchers to examine how the agents were directed and what they attempted.

NorForge designated the Chinese-language activity cluster AIA0001 and described approximately 14 panels and more than 1,100 projects. Some panels exposed credentials and keys, with some reportedly valid, but Fagerland found no evidence that outsiders had used them to take control of the agents. Reuters’ separate review helped identify the corporate victims; the exposed records did not establish the impact on every target.

How Claude Code and DeepSeek Worked Together

One worker carried the name claudecode_deepseek-v4.1-flash. Fagerland interpreted the label as indicating a combination of Claude Code and DeepSeek V4.1 Flash. The operator did not confirm the exact configuration, so the name is evidence supporting the assessment rather than independent confirmation of the underlying setup.

NorForge said the agents received instructions of fewer than 100 Chinese characters. Cairn uses a shared-board, or blackboard, architecture in which agents record findings and proposed actions for other agents to use. That design allows work to continue across multiple steps without a person directing each action individually, although a human operator still defines the task.

Fagerland described the techniques as more sophisticated than routine scanning, telling Reuters, “It’s not script kiddie stuff.” Cairn’s creator, who uses the handle le1xia0, acknowledged receiving questions but did not immediately respond to them. In a public post, the creator said Cairn was a multi-agent architecture and was not designed for hacking.

Other Campaigns Raise Questions About Exposure

NorForge also found exposed Cairn panels associated with attempts to obtain credit-card data and target cryptocurrency services. Some panels appeared to involve legitimate red-team testing, illustrating why the presence of an exposed interface alone is not proof of malicious activity. NorForge assessed the AIA0001 instances as malicious based on the projects and actions visible in the records.

A separate campaign detailed by Gambit Security on Sept. 22 compromised at least 27 companies to varying degrees and obtained more than 600,000 unexpired credit-card records from two companies. Gambit reported using Strix for vulnerability research, Cairn for exploitation and Hermes for orchestration. Those tools were documented in that separate campaign; their use should not be taken as confirmation that the NorForge-observed operation used the same toolset.

The full extent of data extraction and any persistence of access in the NorForge-observed campaign remain unknown. The exposed panels revealed the operators’ activity, but did not establish what information was taken or whether every affected organization had fully eliminated the threat.