Google Threat Intelligence Group (GTIG) reported that attackers used a multi-agent AI framework to steal thousands of credentials in less than six hours. The campaign was carried out by a financially motivated actor who first breached cloud infrastructure and then deployed an autonomous framework consisting of an AI coding chatbot, prompts, and agent instructions.
The report highlights a shift toward reduced human involvement in attacks. While fully autonomous pipelines are not yet common in the wild, a China-linked espionage group attempted to use Gemini to build an automated penetration testing framework for port scanning and service parsing, though Google disabled these assets.
A criminal group known as UNC6780, also tracked as TeamPCP, has targeted the open-source supply chain. This actor poisoned the LiteLLM gateway in March and has since conducted large-scale compromises across PyPI, npm, and Docker Hub by publishing trojanized forks of Model Context Protocol servers.
The group's DUSTMAKER credential stealer targets hidden project directories like .claude and .cursor. Some malware loaders used prompt injections related to biological and nuclear weapons to trick LLM security scanners into skipping malicious JavaScript code.
AI assets themselves have become targets. Mandiant has handled several data theft and extortion cases involving the theft of proprietary models, source code, and prompts from companies in North America and Europe. In one instance, a healthcare company lost drug research and a proprietary model to an extortionist group.
Additionally, UNC6508, another China-linked group, has deployed open-weight models within compromised cloud environments to avoid API monitoring. Another attacker used an exposed GitHub access token in April to provision high-performance GPU instances at a victim's expense.