Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Cybercriminals are using autonomous AI agents to turn compromised cloud systems into rapid credential-harvesting platforms. In a newly documented case, a suspected financially motivated actor planned, built, and ran a large-scale operation in under six hours, taking thousands of third-party credentials.

The intrusion shows how quickly a cloud breach can become a wider identity crisis. Instead of running each task by hand, the attackers used an AI coding chatbot, a prompt, and prepared instructions to scan for weaknesses, gather credentials, fix errors, and change internet-facing addresses while the campaign was active.

Analysts at Google Cloud identified the activity while tracking the wider move from simple AI prompts to autonomous workflows.

Google Cloud said in a report shared with Cyber Security News (CSN) that the campaign used a victim’s own cloud environment, allowing its traffic to appear to originate from legitimate addresses.

The result is a shorter window for defenders to notice and contain abuse. Stolen credentials can unlock cloud accounts, development systems, code repositories, and paid AI services, while a compromised cloud tenant can supply computing power and a trusted-looking launch point for further attacks.

Hackers Use Autonomous AI Agents

The attacker first compromised an organization’s cloud infrastructure, then deployed a multi-agent framework. Preconfigured Markdown instruction sets acted as operational playbooks, telling the system how to handle vulnerability scanning, credential collection, real-time troubleshooting, and IP rotation without continual human direction.

This is more than conventional automation. The agents could respond to problems encountered during scanning and continue the workflow, reducing the pauses that normally occur when an operator must review a failure.

Readers following AI agent attack risks have seen why adaptable activity can be harder to stop than a fixed malicious program. Researchers also found an exposed command-and-control server hosting a framework called Recon.

Its initial directory listing showed agent configuration and knowledge files; soon afterward, the server presented a live dashboard built to organize, validate, and manage more than 23,800 harvested secrets, including cloud and AI-service API keys.

The “Recon dashboard,” shows the management interface described by researchers. The evidence points to an end-to-end post-compromise pipeline that needs little hands-on intervention once it is configured.

Cloud and Development Systems Under Pressure

The campaign reflects an important shift away from endpoint-only credential stealers. Autonomous agents can research exposed weaknesses, inspect server-side systems, run targeted actions, and sort the output at a speed that lets smaller criminal groups operate with the apparent capacity of far larger teams.

Development environments are especially exposed because their accounts often hold valuable tokens and keys. The report also describes DUSTMAKER, tied to UNC6780 or TeamPCP, which targeted AI development tools and CI/CD systems.

A recent GitHub Actions workflow weakness similarly underlines how compromised automation can expose OIDC tokens and push malicious changes downstream.

The broader supply-chain risk is not theoretical. In another case, an automated GitHub supply chain attack affected thousands of repositories in hours, while reports of malicious CI pipeline activity have stressed the value of pinning trusted workflow components to specific revisions.

Organizations should treat cloud credentials, API keys, and AI tool configurations as high-value secrets. They should enforce least privilege, rotate credentials after suspected exposure, monitor cloud activity for unusual scanning and IP changes, tightly review automated workflows, and investigate exposed services quickly.

Google said it disabled assets linked to the observed campaigns and updated protections after the actors’ operational security failures.

Teams should also alert on new service accounts, unexpected public service exposure, unusual use of build runners, and large exports of secrets. Separating production cloud projects from development workloads can limit how far an intruder can move.

Clear incident playbooks matter because a response measured in hours may now be too slow when automated agents are making rapid choices and prevent a single compromised account becoming operational infrastructure.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Package name	tiktoken_mcp	Trojanized MCP server package cited in the UNC6780 supply-chain activity.
Repository name	azure-functions-mcp-extension	Organizational GitHub repository cited as a target for malicious code injection.
Directory	.claude/	Hidden AI coding assistant workspace directory used by DUSTMAKER.
Directory	.vscode/	Hidden IDE workspace directory used to blend malicious files into projects.
Directory	.cursor/	Hidden AI coding environment workspace directory cited in the report.
File name	setup.mjs	Script name that malicious configuration files could instruct an AI assistant to execute.
File name	_index.js	JavaScript loader file containing prompt-injection text intended to disrupt LLM security analysis.
File name	AGENTS.md	Agent configuration file exposed on the Recon command-and-control server.
File name	KNOWLEDGE.md	Knowledge file exposed on the Recon command-and-control server.
File name	agentic_vuln_research.md	Vulnerability-research knowledge file exposed with the Recon framework.
Directory	.openclaw/	Modular framework directory exposed on the Recon server.
Directory	memory/	Modular framework directory exposed on the Recon server.
File name	secrets.json	AI coding assistant configuration file targeted by ACRSTEALER collection rules.
File name	config.yaml	AI coding assistant configuration file targeted by ACRSTEALER collection rules.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.