AI agents stole thousands of credentials in six hours: Google report

Google's Group Threat Intelligence Group (GTIG) has published its observations on how cybercriminals and state-backed groups are increasingly building artificial intelligence into their operations. The core argument from analyst John Hultquist is simple: you can assume that every attacker now uses AI, and it becomes truly alarming in its agentic form — the adversary scales up and moves faster than defenders can react.

An attack in six hours

The most telling example is a financially motivated group that deployed an autonomous multi-agent framework inside a compromised cloud infrastructure. Using an AI coding chatbot, a single prompt and a set of instructions for the agents, the attackers planned, assembled and ran a mass credential-harvesting campaign in under six hours. Pre-written markdown instructions served as “operational playbooks”: the system ran the vulnerability-scanning pipeline on its own, fixed failures in real time and rotated IP addresses without any human involvement. The result — thousands of compromised accounts belonging to other people.

Supply chains and the hunt for AI itself

GTIG links the surge to a group called TeamPCP (also known as Altered Spider, UNC6780), which compromises PyPI, npm and Docker Hub repositories again and again. Once inside, the stealers SANDCLOCK and its successor DUSTMAKER come into play: the first is written in Python, could break out of containers and work with Kubernetes; the second is a cross-platform JavaScript payload tailored for CI/CD pipelines. It was in DUSTMAKER that anti-AI techniques appeared: poisoning the workspaces of coding assistants and prompt injection to bypass defenses.

A separate concern is attackers' interest in corporate AI assets themselves. They steal API keys, proprietary models, prompts and research, and use other people's clouds for their own AI workloads. According to Google, the Chinese group UNC6508 deploys local open-weight models directly inside the environments it has seized — that way the activity slips past the monitoring of AI providers.

Who is using neural networks, and how

The list of examples is long: a Chinese group designed an automated pentesting framework on top of Gemini, Mustang Panda and APT24 used models for reconnaissance and development, Russia's Sandworm — for data collection and social engineering against Ukraine, Iran's APT42 — for reconnaissance. ShinyHunters used Claude Code in an attempt to bypass Cloudflare's protection and parse stolen catalogs for extortion, while underground operators wired Ghidra up to a Gemini-CLI agent to reverse-engineer the components of self-extracting WinRAR archives.

Google is especially worried about open models, particularly “uncensored” builds: they deprive defenders of centralized visibility. At the same time, cutting off access entirely is unrealistic — open models drive the industry forward. The company suggests relying on its Frontier Safety Framework and industry security standards, and advises businesses to use protected platforms such as Gemini Enterprise.

Source: The Hacker News