Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Google's GTIG reports threat actors using autonomous AI agents, credential stealers, and LLMs to steal AI models, API credentials, and harvest thousands of credentials.
72
Malware
SANDCLOCK
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenAug 17, 2026
- Last mentionedSep 8, 2026
Timeline
4 articles · newest firstTwo Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.
68
Google researchers uncover criminal zero-day exploit likely built with AI
Google links a likely LLM-built criminal zero-day for an open-source admin tool to planned mass exploitation and maps AI-assisted threats.
78
LiteLLM Supply-Chain Attack - Technology, Banking and Healthcare the Most Affected
TeamPCP planted the SANDCLOCK credential stealer in LiteLLM PyPI releases, exposing credentials across 2,038 repositories at 898 organizations including Microsoft and NVIDIA.
84
Appears with
- TeamPCPthreat actor · 4
- LiteLLMproduct · 3
- UNC6780threat actor · 2
- CanisterWormmalware · 2
- Trivyproduct · 2
- Google Threat Intelligence Grouporganization · 2
- Googlevendor · 2
- Geminiproduct · 2
- S&P Globalvictim · 1
- Miasmamalware · 1
- PROMPTSPYmalware · 1
- FBIorganization · 1
- Aqua Securityvendor · 1
- Claudeproduct · 1
- PyPIorganization · 1
- Australian Federal Policeorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.