Hackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents threat actors operationalizing agentic AI: in one Mandiant investigation, a financially motivated actor built and executed a credential-harvesting operation in under six hours, with an exposed 'Recon' framework managing more than 23,800 harvested secrets including cloud and AI-service API keys. A Chinese-speaking actor tracked as knaithe used a DeepSeek-powered Hermes Agent for automated reconnaissance and vulnerability enumeration, pivoting from Langflow to n8n and enabling manual exploitation of exposed Citrix NetScaler, Marimo, Apache Tomcat, and VPN infrastructure. Operators harvested Citrix session cookies from process memory to bypass MFA, obtained AWS credentials from compromised Marimo instances, and deployed the Go-based NKAbuse backdoor, with reported RCE and data exfiltration. Google notes fully autonomous end-to-end AI attack pipelines have not yet been observed in the wild.
- Mandiant saw agentic credential harvesting run in under six hours
- Exposed 'Recon' C2 framework managed 23,800+ harvested secrets
- knaithe's DeepSeek-powered Hermes Agent automated recon and targeting
- Session cookie theft bypassed MFA; NKAbuse backdoor on Marimo
- Defenders should hunt rapid scan-fetch-exploit behavioral patterns
- ATT&CK
- T1595.002 Vulnerability ScanningT1190 Exploit Public-Facing ApplicationT1539 Steal Web Session CookieT1003 OS Credential Dumping
- Tags
- agentic-aiai-attackscredential-harvestingdeepseekgoogle-threat-intelligenceknaithemandiantthreat-actors
- Threat actors
- knaithe
- Malware
- NKAbuse
- Organizations
- Google Threat Intelligence GroupMandiantDeepwatch
- AI models
- DeepSeek Hermes Agent
From the original article
4 min read at gbhackers.com
Threat actors are increasingly operationalizing agentic artificial intelligence to compress cyberattack timelines, automating reconnaissance, vulnerability research, exploit development and credential theft with far less hands-on-keyboard activity. However, current evidence points to semi-autonomous, human-supervised attack chains rather than fully independent AI-driven intrusions in the wild.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.