---
title: "Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities"
metaTitle: "AI-Assisted Cybercrime Includes VoIP Fraud"
description: "Unit 42 reveals how a threat actor used jailbroken AI tools to plan VoIP fraud, spoof calls, crack credentials, and exfiltrate thousands of records."
slug: ai-assisted-cybercrime-voip-fraud
date: "2026-10-21T12:00:00-05:00"
featured: true
image:
  src: "https://cdn.securelogix.dev/slx/images/ai-assisted-cybercrime.webp"
  alt: "Sock-clad feet resting on a desk next to a laptop displaying computer code on its screen."
sourcePublisher:
  name: Palo Alto Networks
  url: "https://www.paloaltonetworks.com/"
sourceArticle:
  url: "https://unit42.paloaltonetworks.com/ai-assisted-cybercrime-analysis/"
tags: [Vishing, AI, VoIP Security]
status: published
---

"Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic]," the threat actor typed. The conversation was with one of several AI assistants that the actor was using to get advice on planning and executing a variety of cybercrime activities.

Our visibility into this specific actor's operational environment gives us unique insights into exactly how threat actors are building, testing and executing agentic attacks across multiple campaign types.

Unit 42's investigation into the actor's operational environment and activities makes two things clear: The attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they didn't have the skills these activities would have required before the advent of readily available AI tools. Despite some apparent bumbling, the actor had an impact, attacking a number of targets in India, including universities...