Cybercriminals are increasingly using artificial intelligence to coordinate cyberattacks, with educational institutions in Africa and Latin America among the targets, according to new findings by cybersecurity firm Kaspersky. The attacks involve AI powered penetration testing frameworks known as CyberStrikeAI, which enabled attackers to automate and coordinate several stages of their operations, including network reconnaissance, credential theft, movement across compromised systems and data collection. Kaspersky Threat Research identified the activity between September and October 2026, documenting incidents in which attackers gained access to highly privileged administrator accounts within affected organisations. CyberStrikeAI is an open-source framework that combines a command-and-control infrastructure with a large language model (LLM), allowing human operators to set attack objectives while the AI model selects appropriate tools, generates commands and analyses the results to determine subsequent actions. In one reconstructed case, the attackers first broke into a compromised SQL server and collected information manually before installing the tools they needed, sat idle for two weeks, and then used the CyberStrikeAI implant to resume the intrusion; following deployment, the attack escalated quickly, with attackers gaining control of domain administrator accounts in three to four days, and the final stage, which involved moving between computers, collecting credentials and exporting database information, was completed in less than an hour. Despite the use of artificial intelligence, the technology did not operate directly on the victims’ computers; instead, the AI model ran on the attackers’ server, while the implant installed on compromised machines executed commands and