Check Point Tracks AI’s Expanding Role in Cyber Operations
Summary
Check Point Research’s March–April 2026 digest describes AI use in cyber operations, including a Mexico government breach, Bissa Scanner and EvilTokens, and faster vulnerability discovery and exploitation. It reports 3.6% of enterprise GenAI prompts posed high sensitive
Key points
- Researchers documented an operator compromising nine Mexican government agencies between late December 2025 and mid-February 2026; recovered materials showed 1,088 prompts generating 5,317 AI-executed commands across 34 sessions.
- In the Mexico case, Claude Code assisted exploitation while GPT-4.1 analyzed harvested data. A persistent CLAUDE.md file supplied instructions across sessions, including post-exploitation actions.
- Bissa Scanner had more than 900 confirmed compromises across millions of scanned Next.js endpoints. Researchers recovered over 30,000 distinct .env filenames; the platform harvested credentials for AI providers.
- The report describes malicious agentic configuration files as a developer supply-chain risk. It details attack paths involving Claude Code hooks, MCP configuration, and redirection of ANTHROPIC_BASE_URL; two associated CVEs were patched.
- EvilTokens combines device-code phishing with AI-assisted email analysis and tailored BEC drafts. The report says the platform remained online and continued developing AI features through April.
- The report says LMDeploy SSRF (CVE-2026-33626) was exploited within 12 hours of advisory publication, while a researcher used Claude to help identify CVE-2026-34197.
- Check Point’s enterprise data showed 3.6% of GenAI prompts posed high sensitive-data exposure risk across 91% of organizations using GenAI; 18% of prompts contained potentially sensitive information.
Article Details
- Publisher
- Check Point Research
- Report Period
- March–April 2026
- Scope
- AI use in cyber operations, vulnerability research, phishing, and enterprise GenAI exposure.
- Sample Size
- Not disclosed
- Key Statistics
- One operator compromised nine Mexican government agencies between late December 2025 and mid-February 2026.
- The Mexico breach involved 1,088 attacker prompts generating 5,317 AI-executed commands across 34 sessions.
- Bissa Scanner had more than 900 confirmed compromises and an archive of more than 30,000 distinct .env filenames.
- During March–April 2026, 3.6% of prompts posed a high risk of sensitive data exposure, observed across 91% of organizations actively using GenAI tools.
- LMDeploy SSRF (CVE-2026-33626) was exploited within 12 hours of advisory publication; the article reports no public proof of concept was available.
- Recommendations
- Increase the rate of vulnerability patch development, delivery, and deployment to respond to the compressed disclosure-to-exploitation window.
- Sustain monitoring and policy enforcement for GenAI-related data exposure.
- Treat agentic configuration files in repositories as a supply-chain attack surface.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe EvilTokens delivery workflow used header fingerprint and CSS randomization to disguise messages.T1056 · Input CaptureA malicious proxy could intercept authorization headers in transit.T1059 · Command and Scripting InterpreterAI-generated commands were used during exploitation and post-exploitation workflows.T1068 · Exploitation for Privilege EscalationClaude Code assisted privilege escalation in the Mexico campaign, including activity after root access was gained.T1087 · Account DiscoveryEvilTokens extracted account-related information, including account and routing numbers, from stolen emails.T1090 · ProxyForum users discussed privacy-routed proxies as a way to avoid provider monitoring.T1114 · Email CollectionEvilTokens processed batches of stolen emails for intelligence extraction.T1195 · Supply Chain CompromiseMalicious agentic configuration files embedded in a pull request, honeypot repository, or compromised codebase could compromise a developer machine.T1204 · User ExecutionMalicious repository or settings files could trigger actions when developers opened or used a project.T1552 · Unsecured CredentialsBissa Scanner harvested AI provider API keys from compromised .env files; the article also describes a malicious proxy that could steal authorization headers.T1566 · PhishingEvilTokens used device-code phishing pages impersonating Adobe, DocuSign, and SharePoint to harvest Microsoft OAuth tokens.T1589 · Gather Victim Identity InformationEvilTokens used victim communications and business context to tailor BEC messages and imitate sender style.T1657 · Financial TheftEvilTokens generated BEC drafts and payment-change deception to support wire fraud.
CVE
Threat Actors
Vendors
AnthropicBissa Scanner used Claude Code operationally while harvesting .env files for AI provider credentials, including Anthropic, OpenAI, Groq, Mistral, and HuggingFace.DeepSeek[Organizations/Services ] AI providers targeted for credential theft – Anthropic, OpenAI, Groq, Mistral, OpenRouter, HuggingFace, Replicate, DeepSeekGroqBissa Scanner used Claude Code operationally while harvesting .env files for AI provider credentials, including Anthropic, OpenAI, Groq, Mistral, and HuggingFace.HuggingFaceBissa Scanner used Claude Code operationally while harvesting .env files for AI provider credentials, including Anthropic, OpenAI, Groq, Mistral, and HuggingFace.MistralBissa Scanner used Claude Code operationally while harvesting .env files for AI provider credentials, including Anthropic, OpenAI, Groq, Mistral, and HuggingFace.OpenAIBissa Scanner used Claude Code operationally while harvesting .env files for AI provider credentials, including Anthropic, OpenAI, Groq, Mistral, and HuggingFace.OpenRouter[Organizations/Services ] AI providers targeted for credential theft – Anthropic, OpenAI, Groq, Mistral, OpenRouter, HuggingFace, Replicate, DeepSeekReplicate[Organizations/Services ] AI providers targeted for credential theft – Anthropic, OpenAI, Groq, Mistral, OpenRouter, HuggingFace, Replicate, DeepSeek
Products
Claude CodeDuring March–April 2026, commercial AI models like Claude Code moved into real offensive use across criminal campaigns, espionage, phishing-as-a-service, and vulnerability research.Claude MythosAt the frontier, Anthropic’s Claude Mythos, released through Project Glasswing, reportedly demonstrated a systematic, rapid mechanism to search for vulnerabilities and revealed a very large number of vulnerabilities,Claude Securityimprovements in code, reasoning, and autonomy.” The productized tier is wider and more accessible: Claude Security (running on the public Opus 4.7 model) entered public beta for Enterprise customers, and OpenAI’sclaude-sonnet-4-6[AI Model Names ] Models involved in attack workflows – claude-sonnet-4-6, llama-3.1-8b-instant, llama-3.3-70b-versatile, gpt-4o-miniCodex Security(running on the public Opus 4.7 model) entered public beta for Enterprise customers, and OpenAI’s Codex Security, in research preview since early March, has had 14 CVEs assigned during the preview window onGPT-4.1The Mexico breach showed one operator using a dual workflow: Claude Code for live exploitation and GPT-4.1 for post-exploitation analysis.gpt-4o-mini[AI Model Names ] Models involved in attack workflows – claude-sonnet-4-6, llama-3.1-8b-instant, llama-3.3-70b-versatile, gpt-4o-minillama-3.1-8b-instant[AI Model Names ] Models involved in attack workflows – claude-sonnet-4-6, llama-3.1-8b-instant, llama-3.3-70b-versatile, gpt-4o-minillama-3.3-70b-versatile[AI Model Names ] Models involved in attack workflows – claude-sonnet-4-6, llama-3.1-8b-instant, llama-3.3-70b-versatile, gpt-4o-miniOpus 4.7and autonomy.” The productized tier is wider and more accessible: Claude Security (running on the public Opus 4.7 model) entered public beta for Enterprise customers, and OpenAI’s Codex Security, in research preview
Tools
Bissa scannerBissa Scanner used Claude Code operationally while harvesting .env files for AI provider credentials, including Anthropic, OpenAI, Groq, Mistral, and HuggingFace.EvilTokens#ClaudeCodeOpenClawHere, AI is positioned one step back from the exploitation layer: Claude Code and OpenClaw (running claude-sonnet-4-6, with a Telegram bot for triage alerting) served as the operator’s working environment for reading