South Korea’s fresh financial hacks test whether AI-assisted attacks are becoming a wider threat.

Claude Code session logs turned up on servers used to steal data. AI gave a small crew the reach of a whole team.

Daishin Securities lost personal data on 38,490 customers. Mirae Asset and Bithumb, a crypto exchange, were hit too. Investigators haven't tied the new wave to the earlier campaign, where CrowdStrike, a security firm, found ARTEX, an AI penetration-testing tool, and Claude Code histories on the attackers' servers. Human hands still ran it. AI just let them try many more doors.

• What it could changeIf AI multiplies each attacker's reach, banks will need defenses that scale the same way, not just more analysts.
• How it touches todayRecorded Future, a threat-intelligence firm, says attackers' own operational mistakes are still how defenders catch them.
• Our futureFinancial security could become a race between machines on both sides, with customers' data as the prize.

• Recorded Future reported that the actor tested infrastructure and assembled attack tools weeks before the campaign became public, with tools for cryptocurrency-wallet theft, Linux access, and mobile-device testing.recordedfuture
• Recorded Future described AI as helping attackers pursue more targets across more environments, while operational-security mistakes gave defenders opportunities to identify and disrupt activity.recordedfuture
• A South Korean cybersecurity analysis said ARTEX evidence shows AI-assisted vulnerability analysis and attack automation, but not that AI independently selected targets or conducted the entire attack.blog