Claude‑Code & DeepSeek‑Powered Chinese Espionage Campaign Breaches Government & Financial Systems
What Happened — Hunt.io discovered an active intrusion campaign in June 2026 that leveraged Anthropic’s Claude Code and DeepSeek‑v4‑pro LLMs to automate exploit development, phishing page generation, and credential harvesting. The actors compromised 13 Hong Kong‑based servers, exfiltrated source code, custom exploit scripts, and logs, and used AI‑driven phishing pages to steal credentials from government agencies and financial firms.
Why It Matters for Compliance & Audit Readiness
- AI‑augmented attack automation directly targets the access‑control and credential‑management controls that SOC 2 CC6.1 (Logical Access) is designed to protect; a breach demonstrates a failure to enforce least‑privilege and MFA.
- Continuous‑evidence collection of access‑control logs and AI‑generated phishing simulations helps prove “defensible audit trail” requirements for SOC 2 CC6.2 (User Authentication) and supports ongoing vendor‑risk monitoring.
Who Is Affected — Government agencies, financial services firms, and any organization that exposed source code or login portals to the public internet.
Recommended Actions
- Map the incident to SOC 2 CC6.1/CC6.2 controls, verify MFA enforcement, and tighten privileged‑access review cycles.
- Deploy continuous monitoring of authentication logs and implement AI‑aware security awareness training that covers synthetic‑phishing scenarios.
Technical Notes — The attackers used a unique HTTP header on port 1111 to locate servers, then exploited an open directory (2,431 files) to retrieve code and logs. Claude Code 2.1.165 executed Bash commands and managed sessions; DeepSeek‑v4‑pro generated scripts and selected bypass techniques. Phishing pages were auto‑generated and tested by the LLMs. Source: SecurityAffairs