ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “skill extraction”

2 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 4Threat actor 3AI research 1Industry 1Malware 1
SeverityAllcritical 0high 3medium 2low 0info 5

Threat actors are coming for your AI assets to operationalize their use of AI

Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.

Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.

CSO Online · 2d agoThreat actor in the wild

Hackers abused Claude to extract secrets from 1.8M Android apps

Anthropic reports ShinyHunters, Midnight Blizzard, and GTG-10007 misused Claude to automate credential theft, malware operations, and espionage against dozens of victims.

Anthropic's threat report details how ShinyHunters member 'frkoo' ran a credential-harvesting pipeline on ten AWS EC2 workers that mass-downloaded and decompiled 1.8 million Android APKs, scanning for hardcoded secrets with TruffleHog. In one AI-assisted operation, an actor extracted 2,100+ Azure AD authentication tokens across more than 40 Microsoft tenants in roughly 34 hours, and ShinyHunters affiliates also stole AI API keys and breached a SaaS provider affecting about 200 downstream customers. Russian espionage group Midnight Blizzard used Claude Code skills to automate malware development, phishing, C2, and exfiltration against 20+ government and defense entities, rebuilding malware automatically when detected. Chinese-linked GTG-10007 ran autonomous vulnerability research that uncovered zero-days in a major endpoint security product and hit roughly 50 organizations with confirmed compromises; Anthropic disrupted the abuse and banned the accounts.

BleepingComputerupdated · 19h agofirst · 5d agoThreat actor in the wild 20 sources1