60
60
60
60
60
60
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.
Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.
65
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.
75
60
60
Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience
60
60
60
60
60
Week in review: AiTM phishing kit used to hijack AWS accounts, year-long malware campaign targets HR
60
60
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
60
60
60
60
60
60
60
60
60
Week in review: Cisco SD-WAN 0-day exploited, Patch Tuesday forecast
60
⚡ Weekly Recap: Instagram Account Hacks, Android Zero
60
60
60
Week in review: Microsoft fixes exploited zero-day, Mirai botnets target unpatched Wazuh servers
60
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60
60
60
60
60
Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero
60
60