Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
72
Threat actor
Mustang Panda
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 15, 2026
- Last mentionedSep 8, 2026
Timeline
7 articles · newest firstFBI takes down China-linked hacking network behind attacks on NASA, DOJ and U.S. Senate
FBI seized domains disabling QScan and QTRouter malware run by China-linked QTFY group behind intrusions at NASA, DOJ, Senate and other agencies.
80
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.
65
Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.
70
Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.
65
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
62
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.
62
Appears with
- ToneShellmalware · 4
- PlugXmalware · 4
- Kasperskyvendor · 3
- CoolClientproduct · 3
- Sangforvendor · 2
- Palo Alto Networksorganization · 2
- ToneShellproduct · 2
- Myanmar governmentvictim · 2
- Microsoft Defenderproduct · 2
- Stately Taurusthreat actor · 2
- Unit 42organization · 2
- HoneyMytethreat actor · 2
- PlugXproduct · 2
- CoolClientmalware · 2
- Flax Typhoonthreat actor · 1
- CanisterWormmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.