CyberStrikeAI Uses 44 AI Agents in Hacking Campaign Targeting Japan

TrendAI researchers analyzed three exposed attacker environments linked to separate AI-assisted campaigns targeting organizations in Japan and elsewhere in 2026. One campaign used CyberStrikeAI in a workflow involving 44 AI agents, while the others remained human-led and used AI for planning, tool development, and scripting. Attackers exploited default credentials, exposed services, published vulnerabilities, and credentials stored in configuration files to steal data and establish access. Researchers found no evidence that the campaigns shared an operator, and the underlying AI models remain unidentified.

The findings highlight AI’s role in accelerating and scaling established intrusion techniques rather than introducing fundamentally new exploitation methods. The reporting also describes broader adoption of agentic AI for credential attacks, ransomware intrusions, cryptocurrency mining, and autonomous exploitation. For defenders, the immediate priorities remain eliminating default credentials, restricting exposed services, patching known vulnerabilities, and removing secrets from configuration files. Security teams should also assess whether detection and response processes can keep pace with faster, automated attack workflows.