China-Linked Hackers Deploy AI Agents in Taiwan Cyber Campaign

Taiwan’s semiconductor, manufacturing and supply-chain sectors have long been targets of China-linked cyber espionage. The latest campaign marks a shift from using generative AI as a coding assistant to embedding it in live attack workflows. Claude Code handled command execution, persistent sessions and parallel tasks, while DeepSeek-v4-pro supplied attack reasoning, adapted exploits and helped build phishing pages, potentially allowing intrusions to advance faster than conventional human-led operations.

Hunt.io disclosed the campaign on July 14, 2026, after tracing TencShell infrastructure in June to 13 Hong Kong-based servers across four autonomous systems. The network scanned more than 5,890 government hosts in 10 countries. In Taiwan, eight supply-chain and manufacturing organizations were reconnoitered and two had been compromised as recently as June 11, including a chemical company and a telecom and edge-device manufacturer. An exposed directory held 2,431 files across 80 subdirectories; no financial loss was disclosed.