When AI Turns Rogue: How attackers use DeepSeek for hacking

Why Criminals Prefer DeepSeek

Every major AI company builds safety filters into its models. These filters are supposed to stop the AI from answering harmful requests, such as writing malware or planning a scam. Western models like GPT-4o and Gemini block a large share of these harmful requests. DeepSeek does not. In one well-known security test, DeepSeek failed to block a single harmful prompt, while GPT-4o blocked around 86 percent of them and Gemini blocked about 64 percent. Separate research has gone even further, finding that DeepSeek is roughly eleven times more likely to be exploited by cybercriminals than other AI tools on the market. Taken together, these numbers paint a clear picture: DeepSeek was not built with the same safety priorities as its Western competitors, and criminals have noticed.

This gap in security is exactly why attackers are drawn to DeepSeek, but it is not the only reason. DeepSeek is also open source and far cheaper to run than most competing models, which matters to criminal groups that want to automate large volumes of fraud at minimal cost. Analysts who track Chinese-speaking hacking communities have noted that DeepSeek has become the AI of choice precisely because it combines real technical power with very few guardrails, while Western models, even when they can eventually be tricked, require far more effort to bypass. For attackers running fraud at scale, that difference in effort adds up quickly.

A criminal who wants a convincing phishing email, a piece of malware, or a script to steal login credentials does not need advanced hacking skills anymore. They only need the right prompt. Security researchers have shown that DeepSeek can be pushed, using jailbreak techniques with names like “Crescendo” and “Deceptive Delight,” into producing phishing templates, keylogger scripts, and even fake investment pitches that sound completely genuine. These jailbreaks work by gradually steering the conversation or disguising a harmful request inside an innocent-looking one, until the model’s weak safeguards simply give way. In controlled comparisons, DeepSeek has also produced noticeably more detailed and convincing fraud content than other models when given the same prompt, including invented bank addresses and staff names that make a fake message feel authentic. Because the model writes fluent, natural text in many languages, these messages are hard to spot as fraud, even for careful readers, and they no longer carry the spelling mistakes or awkward phrasing that used to give older scams away.

From Chatbot to Autonomous Attacker

The danger goes far beyond writing scam emails. In the summer of 2026, security researchers at Palo Alto Networks uncovered a striking case. A Chinese hacker connected DeepSeek to an open-source tool called Hermes Agent and let it run largely on its own. Over four days, this AI-driven system attacked more than 460 organisations. It searched the internet for vulnerable servers, selected the right exploit code from public sources, and launched the attacks itself, almost without any human involvement. Fourteen of these attacks succeeded, all against systems that were running known, unpatched vulnerabilities.

What makes this case remarkable is not only the scale of the attack, but also how it came to light. According to reporting on the incident, the attacker had first tried to build the same automated attack pipeline using Western AI models, but those models refused to cooperate. Only after switching to DeepSeek did the pipeline start working. This detail shows clearly how a model’s weak safety design can turn it into a tool for large-scale, automated crime, something that used to require a whole team of skilled hackers.

Fraud That Hides Behind DeepSeek’s Name

There is a second, quieter form of abuse. As DeepSeek’s app became one of the most downloaded AI tools in the world, scammers began creating fake websites and apps that copy its design and branding almost perfectly. Security researchers have tracked dozens of these lookalike domains, many of them registered or updated on the very same day DeepSeek’s popularity surged, a clear sign that criminals were watching the news closely and moving fast to cash in on it. Some of these sites use typosquatting, meaning web addresses that look almost identical to the real one, while others use homoglyphs, characters that visually resemble letters in DeepSeek’s actual name, to trick even attentive users at a glance.

Victims are lured to these fake platforms with promises of exclusive access, early investment opportunities, or a supposed official DeepSeek cryptocurrency token. Many of these sites ask users to scan a QR code to “connect their crypto wallet,” a step that instead hands full control of the wallet to the attacker, often resulting in the total and permanent loss of funds. Others trick people into entering their Google login details on a convincing but fake DeepSeek sign-in page, or lead them to fake Telegram bots designed to look like official DeepSeek support, where the bot’s real job is to collect credentials or push victims toward a fraudulent investment scheme. Some of these fake tokens have even turned out to be honeypots, meaning the coins victims “purchase” are worthless by design and can never be resold.

The abuse of DeepSeek’s brand goes beyond fake websites. Criminals have also distributed malware, including an information-stealing tool known as AMOS Stealer, disguised as a legitimate DeepSeek app download, capable of harvesting credentials and exfiltrating sensitive data once installed. On top of this, DeepSeek itself has publicly complained about a wave of fake social media accounts impersonating the company and even its founder, Liang Wenfeng, spreading misinformation and promoting bogus offers across platforms such as WeChat, X, and RedNote. Together, these tactics have made it increasingly difficult for ordinary users to tell a genuine DeepSeek offer from a scam wearing its name.

What This Means for Small and Medium Businesses

For SMEs, this trend should be taken seriously rather than treated as a distant problem for large corporations. Automated, AI-driven attacks make it cheaper for criminals to target many smaller organisations at once, instead of focusing only on large enterprises with bigger budgets. A single unpatched server, an outdated plugin, or a well-written phishing email can now be found and exploited by an AI system working around the clock, without a human attacker ever getting tired or making a careless mistake.

The most effective defence is still the most familiar one. Patch known vulnerabilities quickly, since the Palo Alto Networks case showed that every successful breach relied on flaws that had already been fixed months earlier. Train employees to recognise phishing attempts, even when the language sounds unusually polished or professional, because AI-written scams no longer contain the spelling mistakes that used to give them away. Use multi-factor authentication wherever possible, and treat unexpected messages about crypto wallets, urgent payments, or account verification with healthy suspicion, regardless of how convincing they look.

AI tools like DeepSeek are not going away, and neither are the criminals who misuse them. Understanding how these attacks work is the first step toward staying ahead of them.