Hackers build AI frameworks for widescale credential theft
Google GTIG details threat actors using autonomous multi-agent AI frameworks to automate attacks, including a six-hour credential-harvesting campaign and a 23,800-secret Recon panel.
Google Threat Intelligence Group (GTIG), drawing on Mandiant telemetry, reports threat actors are moving from AI coding assistants to autonomous multi-agent frameworks that automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. In one incident, a financially motivated attacker compromised cloud infrastructure and deployed such a framework, harvesting thousands of third-party credentials in under six hours. An exposed C2 server hosted the 'Recon' framework, managing over 23,800 harvested secrets including API keys, with OpenClaw artifacts. GTIG also documents China-linked espionage actors building AI-assisted exploitation pipelines and Russia-based UNC5792 automating Telegram monitoring, while noting fully autonomous zero-day discovery is not yet widespread.
- Financially motivated attacker harvested thousands of credentials in under six hours via autonomous AI agents
- Exposed C2 hosted 'Recon' framework managing 23,800+ secrets with OpenClaw artifacts
- China-linked espionage actors testing AI-assisted exploitation and post-exploitation pipelines
- Russia-based UNC5792 automates Telegram monitoring bots; UNC6780 tied to supply-chain attacks
- GTIG says fully autonomous zero-day discovery and network exploitation not yet observed against real targets
From the original article
2 min read at bleepingcomputer.com
Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.