Hackers Are Using AI. Are You?

I spent the last few weeks cleaning up after hackers.

Four clients, four different attacks.

Every one of them showed me the same thing from two directions.

Hackers used a known WordPress plugin vulnerability to compromise a music site. A standard drive-by attack on a site left to rot by the owner. The bot planted many backdoors, PHP shell kits, scanning tools, and more, and even installed hooks into the WordPress cron system to reinstall itself. Standard stuff.

The goal? Well, there was not much value on the site unless you are really into MIDI music samples. Instead, the goal was simple: compromise a system so you can steal resources to scan for more vulnerable sites and run DDoS attacks and phishing campaigns.

This attack is easy to investigate, but time-consuming.

Now AI handles it.

I fed the AI the logs, provided guidance on what to look for, told it which tools were available, and let it chug away.

Twenty minutes later, I had a report.

Claude Code identified the likely plugin and attack time from logs. The report referenced related CVEs and flagged other plugins with exploits, though they weren’t used this time.

This report made cleanup easy. Roll back to the last good backup, remove and update the plugins. Rescan for issues. Done.

What would have taken me hours in the past took only about 30 minutes of hands-on time.

An education site got hit with something more deliberate. This company rates schools, summer camps, after-school programs, and more. They have a large database of over 3000 programs across some 300 schools, with very detailed metrics that you cannot find elsewhere. A useful guide for parents looking to get the best for their children.

The data was valuable, and someone wanted it.

Over 600 IP addresses started systematically extracting the data. Each one made exactly ten requests to carefully crafted URLs. IPs spanned dozens of countries. Someone had pre-built a list of every comparison URL they wanted and distributed the work across a botnet (a network of infected computers controlled by an attacker) to stay under every detection threshold.

As I reviewed the patterns, I suspected some AI tools were involved as well. I would see failed requests that were changed in near real time, slightly adjusting their behavior to get the data they were after.

I had been investigating some performance issues for about a week. Nobody realized the slowness was the attack — it was hiding in the noise of legitimate bot traffic. AI crawlers, SEO tools, the usual background hum of the modern web. The real threat was buried in the noise.

AI cut through the noise.

I fed the logs to Claude Code to look for patterns. Within minutes, it found something. Something I would likely have missed in manual review or with a standard log analysis tool.

The User-Agent was fake.

Not obviously fake — I would have caught that. But an odd mix of Chrome version and OS, with very low usage and no longer in use.

I also suspected the attackers were scraping source code to obtain the URLs of their targets. The problem is that this is a JS-powered app. A typical crawler would not see the data. So a headless browser would be needed. Logs suggested this as well, with headless Chrome popping up from time to time. This would have taken the hackers hours to do — unless they were using AI as well.

When money is on the line, you have to respond fast.

A community site with a built-in marketplace got hit with a full Account Takeover campaign. This was a scripted, highly automated fraud operation. The attackers had a playbook.

I could see the fraud attempts in real time, but stopping them was a different problem.

The criminals took over trusted accounts — members who’d been on the platform for years — and used them to run impersonation campaigns through the site’s own messaging system. One compromised account sent 884 scam messages. Another session blasted over 400 from various hacked accounts.

But something was different this time. The scam messages weren’t generic. They referenced personal details scraped from member profiles, written in a way that felt familiar.

This wasn’t just automated. It was AI-assisted.

The attack, I understood. The legacy codebase was the problem: thousands of undocumented lines, no frameworks, many developers over fifteen years, and no one left who could fix it.

I fed over ten million lines of server logs into Claude Code. Thirty minutes later, I had real signals.

• Confirmed compromised accounts.

• Attacker timelines reconstructed by IP.

• Attack methods are classified and separated by vector.

When the analysis drifted toward false correlations, I pulled it back.

• What IP hit this endpoint the most?

• Which user sent the most PMs?

• What user-agent is hitting the personal messaging system?

Most importantly, the system helped me identify possible endpoints in the application that were being exploited.

I had Claude Code analyze these endpoints and tell me how they worked. I did not have time to read and analyze thousands of lines of code.

Without AI, I would have shut the site down while I manually picked through the code.

With Claude Code, four hours.

McKinsey recently reported a 1,200% surge in phishing attacks since the rise of generative AI.

Their advice?

• Integrate AI into your security stack.

• Invest in third-party platforms.

• Build a dedicated team monitoring threats around the clock.

That’s fine if you’re an enterprise with a security team and huge budgets.

But if you are a mid-sized company without a seven-figure cybersecurity budget and a dedicated security team, what do you do?

Fight back using AI.

The core principle is simple.

Use AI to detect, investigate, and respond faster. It works at any scale.

Nearly every tool I used across these three investigations was free, open source, or low-cost. Claude Code, Semgrep, Ripgrep, Snyk, and standard server logs. What made them effective wasn’t the price tag. It was knowing what to look for and how to point AI at the problem.

The attackers are upgrading their tools; you’d better start upgrading yours.

I’m Jeff Huckaby, founder of rackAID. I help established businesses make sound technology decisions — connecting technical activity to business outcomes.

This piece was written with the help of AI agents — managed, not prompted.