Outgunned With Better Aim: How AI-Assisted Defense Beat an AI-Coordinated Attack
5:55 AM. A fraudulent Mastercard appeared on a Steam account I own. Funds loaded. Purchases initiated. One minute. I was still asleep.
6:13 AM. Account language switched to Traditional Chinese — a documented technique for routing confirmation emails into a script the victim likely can't read fast enough to respond to. Account drained through Umamusume: Pretty Derby, a gacha title with a documented fraud history, where in-game purchases convert to untraceable value the moment they clear. Two minutes.
6:14 AM. The attackers were gone.
7:49 AM. I had the account back.
1:03 PM. Every charge reversed.
That's 57 minutes from waking up to account recovery. The attack itself took 18 minutes. The tool most likely used to coordinate it was an LLM running a scripted fraud playbook. The tools I used to investigate, respond to, and recover were also LLMs. The difference was knowing how to use them.
I have 25 years in cybersecurity. Here's what I learned, what held, and what I still don't know.
The Posture
This isn't the part of the story where I explain how I failed to use 2FA or reused a password somewhere. I didn't.
What most CISOs claim but few actually implement is defense in depth that covers every surface — not the important ones, every one. A decommissioned Lycos page is a breadcrumb. An old hobby forum is a pivot point. Compromise of the most trivially stupid old account can yield modern, relevant information about a real person. If it exists and has my name on it, it either has 2FA and a passkey or it's been decommissioned and deleted properly. No passwords are reused. Ever.
Social media lives in jails — isolated browser instances, each managing only its designated accounts, nothing cross-linked. No Meta products of any kind. No Facebook. No Instagram. The personal stays personal, the professional stays professional, and neither knows the other exists.
The physical setup matched the philosophy:
- Fresh build, under six months old
- Dual-boot: Windows alongside LUKS-encrypted Ubuntu Studio and Kali Linux; bootloader controlled by the Linux install; tamper tripwire in place
- Boot password required; no attached peripherals when unattended
- Compartmentalized Gmail accounts — each scoped to a single purpose, none cross-linked, decommissioned accounts on auto-delete
- Steam's recovery email on a separate Apple device, never connected to the affected machine
- Two isolated browsers, each managing only its designated accounts
- Installed software: a deliberately minimal, audited list
- A homegrown AI-assisted social media automation daemon — native PowerShell on Windows, Python on Linux; zero npm dependencies; multiple security reviews across models
- YubiKey migration already planned before this happened
Malwarebytes found nothing. Because there was likely nothing to find on the machine itself.
The Attack
5:55 AM — Fraudulent Mastercard added under a throwaway identity. Funds loaded. Purchases initiated. One minute. Automated.
6:13–6:14 AM — Account language switched to Traditional Chinese. Account drained through Umamusume: Pretty Derby. Two minutes. Also automated.
7:17 AM — Last automated action logged. Done and gone.
7:49 AM — Account recovered.
1:03 PM — All charges reversed.
10:48 PM — Second attempt. Manual this time. A human, frustrated, trying again after the pipeline failed. Locked out again within minutes.
That two-phase signature tells the whole story. The 5:55–6:14 window was a bot running a rehearsed playbook — scripted, professional, practiced. The 10:48 attempt was someone realizing the automation had failed and trying to salvage it by hand. You can read the frustration in the timing.
The Traditional Chinese switch is a documented technique. It buys time by routing confirmation emails into a language the victim probably can't parse at speed. The assumption: "Traditional Chinese" and "legible to the account owner at 6 AM" don't overlap.
That assumption failed here.
The Response
Gemini translated the emails in real time. Not after the fact — during active recovery, in a separate instance, while simultaneously navigating Valve's support system and pushing every available path to get detailed tickets submitted.
Multiple AI instances running in parallel, each assigned to what it does well: translation, reasoning, documentation, escalation language. The class of tool most likely used to coordinate the attack is the same class I ran on defense. The difference was knowing how to use it.
Claude conducted the forensic investigation — pulling and auditing Chrome extension packages in real time, verifying CRX3 cryptographic signatures, diffing shipped bundles against GitHub source, tracing the attack timeline, closing each potential vector one by one until the picture was clear.
Two Chrome extensions were fully audited:
playwright-crx(ruifigueira): all 293 source files byte-identical to the public GitHub tag, no exfiltration primitives, signatures verified against upstream Microsoft Playwright v1.53.0- Microsoft's official Playwright Extension: cryptographically tied to the public repo by key derivation, loopback-only WebSocket, no credential access
Both clean. The daemon clean. The software list clean. The email accounts clean. Physical access eliminated. Remote access eliminated.
57 minutes. That speed came from knowing which model to use for which task, how to structure prompts to get analytical output rather than hallucinated reassurance, and when a vector was genuinely closed versus when it needed another pass.
What Held
The iCloud separation was decisive.
Steam's recovery email lived on Apple, on a separate device that has never been connected to the affected machine. The attackers could change the account language. They could drain the balance. They could not change the recovery email. Full account takeover was structurally impossible. Recovery was inevitable.
The compartmentalization held. Nothing cross-linked meant nothing cascaded. One service was hit. The blast radius stopped there. That's the entire point of the architecture — not to prevent every breach, but to contain it when it happens.
The response speed held. 57 minutes isn't luck. It's knowing your systems cold, knowing your tools cold, and not being paralyzed by the nature of what you're facing — even when the mechanism on the other side is the same class of tool you're running.
What Remains Unknown
How the session token left the machine.
A full forensic pass from Kali Linux — Windows partition mounted read-only, Windows Event IDs around the attack window, Chrome extension install timestamps, Steam config file modification times — is the next step. It may give an answer. It may not.
Sometimes that's the reality of incident response. You remediate completely and still don't get clean attribution. What matters is the remediation.
What Comes Next
Full Kali forensic pass before wiping. Both Windows systems reimaged. Automation daemon rewritten in Perl on Linux — smaller footprint, no pip ecosystem, no upstream exposure. YubiKey plus Authenticator replacing current 2FA. Steam and DayZ reinstalled clean.
The vault gets rebuilt. Better.
The Point
Security professionals talk about defense in depth, compartmentalization, zero trust, 2FA on everything. Most of them mean on the important things. The discipline that matters is applying it to everything — every account, every surface, every day — and not creating meta-connections that let one compromise become ten.
The second point, the one worth sitting with:
The attack was likely coordinated with AI. The defense was conducted with AI. The outcome was determined by who understood their tools better, applied them faster, and wasn't afraid of the mechanism just because it was also on the other side.
That's the new baseline. Not whether AI is involved. It is. The question is which side uses it better.
Alexius McMullin has 25 years in cybersecurity. He also has 2,100 hours in DayZ, a bearskin hat earned within an hour of the 1.28 update, and strong opinions about the KA-M versus the VSS for clearing Cherno on foot. The fraudulent purchase was Umamusume: Pretty Derby. It could not have been more obviously wrong.