China Hackers Test AI-Optimized Attack Chains in Taiwan

A Chinese threat actor known as DropPitch has been testing whether artificial intelligence can enhance its cyberattacks against Taiwan. In an April and May 2025 wave, DropPitch targeted Taiwan’s semiconductor sector, focusing on major investment firms in that space rather than manufacturers or government entities.

The researchers note that activity then increased significantly in June and July, with the group widening its target list to finance and semiconductor sectors, academics and think tanks in Taiwan and the US, and other organisations linked to CCP-critical groups.

DropPitch used ChatGPT to generate phishing emails in multiple languages and to help optimise a rudimentary backdoor called HealthKick, while exploring how to secure its command-and-control traffic, though the backdoor remained basic and occasionally included odd artefacts. The attackers later shifted tactics again, returning to person-to-person engagement before malware deployment, suggesting a retreat from AI-driven innovation toward traditional methods. According to OpenAI, while there is evident interest in AI among threat actors, its transformative impact remains largely theoretical.