Vibe hacking, HexStrike AI and the latest scheme from Scattered Lapsus$ Hunters
Experts discuss the weaponization of AI in cybercrime, from "vibe hacking" that lowers the barrier for attackers, to frameworks like HexStrike AI enabling AI agent armies. The conversation covers new extortion tactics and the evolution of malware like Remote Access Trojans (RATs).
The Inevitable Rise of “Vibe Hacking”
The concept of “vibe hacking” represents a significant lowering of the barrier to entry for cybercriminals. Similar to “vibe coding,” where a user describes a desired software outcome to a generative AI, vibe hacking applies the same workflow to cyber attacks. A recent Anthropic threat report highlighted a case where a threat actor used an AI not just to write malicious scripts but also for tactical and strategic decisions, such as determining which data to exfiltrate and setting a ransom amount.
The panel agreed that this development was “absolutely inevitable.” This shift marks the beginning of an “AI vs. AI” arms race, moving the conflict to a new AI battlefield where the organization with the superior and most updated AI will have the advantage. AI is a classic dual-use technology, and organizations that have been slow to adopt AI for defense will be the ones who lose.
This trend puts pressure on the traditional affiliate model of cybercrime. With AI, a threat actor no longer needs to be a skilled programmer or rely on malware-as-a-service platforms; they can simply articulate their malicious intent to an AI assistant. To counter this, defenders must adopt a “vibe security” approach—an experiential, reactive method where red and blue AI agents learn from each other to combat these new threats.
HexStrike AI and the Dawn of AI Agent Armies
HexStrike AI, an offensive security framework designed to orchestrate large numbers of AI agents for legitimate purposes like automated red teaming, has been co-opted by threat actors. They are weaponizing it to command their own armies of malicious AI agents and rapidly develop exploits for complex vulnerabilities.
This development, while alarming, is seen as a variation on a familiar theme. It harkens back to the release of “SATAN” (System Analyst Tool for Analyzing Networks) roughly 25 years ago—a controversial tool that automated network vulnerability scanning and was feared to be the end of security as we knew it. While today’s tools are more advanced, the fundamental dynamic of an arms race between attackers and defenders remains. The key difference now is the accelerated pace of evolution, which demands that defenders react much faster than ever before.
Would You Rather: Human vs. AI Attacker?
The panel debated whether they would rather defend against a human hacker or an AI agent, revealing different strategic perspectives:
- Against a Human: One panelist chose to face a human, arguing that humans have biological limitations—they need to eat, sleep, and rest. An AI, by contrast, is a relentless nightmare that “never sleeps, it never stops.”
- Against an AI Agent: Two panelists leaned towards facing an AI, but for different reasons. One argued that a single human is more predictable than an AI trained on the unpredictable actions of many humans. The other saw a current, tactical advantage in exploiting AI’s tendency for hallucinations and confabulations, potentially turning the AI’s attack back on itself. However, they noted this advantage is temporary and may disappear as AI technology matures.
A New Extortion Tactic: Firing Employees
The cybercrime group “Scattered Lapsus$ Hunters,” a collaboration between Scattered Spider, Lapsus$, and ShinyHunters, has introduced a novel extortion demand. After claiming to possess internal Google data, they are threatening to leak it unless Google terminates two specific security employees.
The panel views this as the attackers “overplaying their hand.” This is not a standard ransomware attack seeking financial payment but rather a mafioso-style tactic to stop Google from investigating them. The consensus is that capitulating to such a demand is unthinkable. It would set a dangerous precedent, inviting every hacker collective to make similar demands. Giving in to blackmail only makes an organization a “welcome soft target” for future attacks.
The Resurgence of Remote Access Trojans (RATs)
A recent report from Recorded Future indicates a significant shift from info-stealers to Remote Access Trojans (RATs). The panel, however, sees this less as a shift and more as a “battle of naming conventions” or an evolution. A RAT is essentially an “info-stealer on steroids.”
While traditional info-stealers focus on credentials and keystrokes, RATs offer attackers complete control over a device. They can activate cameras and microphones, record conversations, steal a user’s likeness for deepfakes, and gather highly personal material for extortion. The proliferation of mobile phones, which serve as a hub for both personal and professional life, makes them a prime target for this more invasive form of attack.
Defending against RATs doesn’t require a brand-new security paradigm. The fundamentals remain critical:
- Basic Hygiene: Just like in a pandemic, basic hygiene is crucial. This includes patching systems, using malware scanners, and employing behavior-detection tools.
- Modern Controls: Adopting modern approaches like passwordless authentication is key. As one expert noted, “if you don’t have a password, you cannot steal it.”
- The Human Element: Social engineering remains a primary attack vector. Since you cannot “patch” human behavior, the focus should be on automating security controls to mitigate the damage from an inadvertent click, preventing it from escalating into a full-blown compromise.