{ "updated": "2026-10-23", "incidents": [ { "id": "carliy0s-aipt-67-pentagi-latam-banks", "title": "AiPT-67 'CyberCartel' builds CARLIY0S on PentAGI against Latin American banks", "date": "2026-10", "disclosed": "2026-10-22", "actor": "AiPT-67 (CyberCartel)", "actor_type": "criminal", "nexus": null, "targets": "Latin American banks and financial institutions (title cites 400+)", "ai_role": [ "recon", "exploit-dev", "agentic-intrusion", "ops-automation" ], "models": [ "Kimi", "Claude Sonnet", "Claude Opus", "Grok" ], "model_basis": "stated-by-researcher", "autonomy": "semi-autonomous", "outcome": "Straiker reports a decentralized AI attack system run against hundreds of institutions; impact details not independently verified here.", "confidence": "CONFIRMED", "confidence_reason": "Straiker, as primary investigator, describes the framework and models; exact publication date was not confirmed.", "summary": "Straiker says the group moved from manual hacking to CARLIY0S, built on PentAGI, using several commercial models for different attack stages and custom MCP servers bridging LLMs to Burp Suite.", "quote": "the group has moved from manual hacking and script-based automation to a decentralized attack system named CARLIY0S, built on the PentAGI autonomous offensive framework", "sources": [ { "title": "CARLIY0S: CyberCartel's AI Attacks on Latin American Banks", "publisher": "Straiker", "url": "https://www.straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks", "date": "2026-10-22", "kind": "primary", "verified": true } ] }, { "id": "mandiant-hijacked-ai-assistant-shai-hulud", "title": "Attacker hijacks developer's live AI coding session to spread Shai-Hulud worm", "date": "2026-09-15", "disclosed": "2026-09-15", "activity": "2026", "actor": "Unnamed", "actor_type": "unknown", "nexus": null, "targets": "A SaaS provider and its developers (about 100 internal repos)", "ai_role": [ "agent-hijack", "supply-chain", "malware-dev", "ops-automation", "evasion" ], "models": [ "unspecified LLM" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "Poisoned PyPI package installed, GitHub OAuth tokens stolen, worm deployed across ~100 repos, source code exfiltrated.", "confidence": "CONFIRMED", "confidence_reason": "Mandiant investigated the intrusion directly (case study 1).", "summary": "After compromising a SaaS provider the actor hijacked an active AI coding assistant session whose recommendation installed a poisoned package. The attacker then used the session to deploy the self-propagating Shai-Hulud worm. Report and incident dates are approximate.", "quote": "hijacked an active AI coding assistant session on a developer's workstation", "sources": [ { "title": "AI risk and resilience in 2026: A Mandiant special report", "publisher": "Mandiant / Google Cloud", "url": "https://cloud.google.com/security/resources/ai-risk-and-resilience-2026", "date": "2026-09-15", "kind": "primary", "verified": true } ] }, { "id": "gtg-10007-exploit-foundry-2026", "title": "Chinese operators ran an AI exploit foundry and agent swarms", "date": "2026-09-10", "disclosed": "2026-09-10", "activity": "2026", "actor": "GTG-10007", "actor_type": "nation-state", "nexus": "China", "targets": "About fifty organizations including Southeast Asian government agencies", "ai_role": [ "vuln-research", "exploit-dev", "recon", "agentic-intrusion", "malware-dev" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "autonomous", "outcome": "Intrusions into an ed-tech firm and a retailer; zero-day findings; accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic reports from its own investigation.", "summary": "Claude drove binary reversing, exploit writing and reconnaissance loops, producing a dozen possible zero days in a month.", "quote": "a lead AI agent decomposed reconnaissance and post-exploitation work and dispatched it to many subagents running in parallel", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "gtg-20006-russian-espionage-2026", "title": "Midnight Blizzard-linked GTG-20006 automated espionage and malware rebuilds", "date": "2026-09-10", "disclosed": "2026-09-10", "activity": "2026", "actor": "GTG-20006 (consistent with Midnight Blizzard)", "actor_type": "nation-state", "nexus": "Russia", "targets": "Ukrainian and European governments, defense, drone suppliers", "ai_role": [ "recon", "agentic-intrusion", "malware-dev", "evasion", "phishing-content", "ops-automation" ], "models": [ "Claude Code", "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "autonomous", "outcome": "20+ organizations targeted; mailboxes exfiltrated; accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic reports from its own investigation and attribution.", "summary": "AI agents watched for detections of the actor's malware and rebuilt it until undetected, and ran phishing and infrastructure workflows.", "quote": "agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "gtg-30004-iran-osint-malware-2026", "title": "Iran-nexus GTG-30004 built OSINT profiling and obfuscated NanoDump", "date": "2026-09-10", "disclosed": "2026-09-10", "activity": "2026", "actor": "GTG-30004", "actor_type": "nation-state", "nexus": "Iran", "targets": "Israeli officials and Jewish diaspora organizations", "ai_role": [ "recon", "malware-dev", "evasion", "data-analysis" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Accounts disrupted.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic reports from its own investigation.", "summary": "The actor used Claude to orchestrate an OSINT profiling harness and an obfuscation pipeline for a modified NanoDump.", "quote": "modified an open-source LSASS credential dumper, NanoDump, and built a bespoke C++ obfuscation/build pipeline", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "gtg-50014-shinyhunters-affiliates-2026", "title": "ShinyHunters affiliates used Claude for mass smash-and-grab breaches", "date": "2026-09-10", "disclosed": "2026-09-10", "activity": "2026", "actor": "GTG-50014 (suspected ShinyHunters affiliates)", "actor_type": "criminal", "nexus": null, "targets": "SaaS vendors, an airline, a technology provider and others", "ai_role": [ "agentic-intrusion", "exploit-dev", "data-analysis", "ops-automation", "recon" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "1TB+ stolen from one provider; data of about 200 downstream customers taken; accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic describes disrupted clusters from its telemetry.", "summary": "Claude helped scan, exploit and exfiltrate, including a three-hour jump from one developer token to cloud admin.", "quote": "wherein operators direct AI to achieve general goals", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "gtg-50020-ai-supply-chain-2026", "title": "GTG-50020 injected prompts into an AI vendor sandbox to steal API keys", "date": "2026-09-10", "disclosed": "2026-09-10", "activity": "2026", "actor": "GTG-50020", "actor_type": "criminal", "nexus": "Russia (Russian-speaking)", "targets": "Hotel booking and fintech platforms; about thirty AI companies", "ai_role": [ "agentic-intrusion", "ops-automation", "exploit-dev", "agent-hijack", "llmjacking", "supply-chain" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "About 26 GB stolen from one victim; AI keys stolen; pre-release model access never obtained.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic reports from its own investigation.", "summary": "The actor used stolen keys and AI pentest loops against victims and about thirty AI firms.", "quote": "By injecting malicious instructions into an AI vendor's automated evaluation sandbox, the actor caused the sandbox to hand over the credentials it held", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "gtg-50021-fake-claude-reseller-credential-harvest", "title": "Fraudulent cheap-Claude reseller harvests Anthropic credentials", "date": "2026-09-10", "disclosed": "2026-09-10", "activity": "2026", "actor": "GTG-50021 (alias kl1zy)", "actor_type": "criminal", "nexus": null, "targets": "Customers seeking discounted Claude access", "ai_role": [ "fraud", "llmjacking" ], "models": [ "Claude (impersonated)", "unspecified substitute model" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Traffic silently proxied to another model while a harvester stole Anthropic account credentials for resale.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic investigated and lists indicators of compromise.", "summary": "A Russian and Ukrainian-speaking group sold fake discounted Claude access that was neither cheap nor Claude. Stolen credentials were sold on to other AI proxy resellers.", "quote": "They ran a fraudulent AI reseller operation offering cheap Claude access", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "basin-castle-genai-2026", "title": "BASIN CASTLE used LLMs for recon, lures and obfuscated malware", "date": "2026-09-08", "disclosed": "2026-09-08", "activity": "2026", "actor": "BASIN CASTLE (BASIN, TEMP.Hex)", "actor_type": "nation-state", "nexus": "China", "targets": "High-value targets", "ai_role": [ "recon", "phishing-content", "malware-dev" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the activity.", "summary": "The group used LLMs to profile targets, draft localized lures, write obfuscated custom malware and fix post-exploitation commands.", "quote": "has integrated generative AI across successive phases of the attack lifecycle", "sources": [ { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "date": "2026-09-08", "kind": "primary", "verified": true } ] }, { "id": "midnight-neptune-dprk-crypto-ai-2026", "title": "MIDNIGHT NEPTUNE used LLMs for RATs, lures and lateral movement", "date": "2026-09-08", "disclosed": "2026-09-08", "activity": "2026", "actor": "MIDNIGHT NEPTUNE (formerly UNC1069)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Cryptocurrency organizations", "ai_role": [ "malware-dev", "social-engineering", "ops-automation" ], "models": [ "Gemini", "DeepSeek-Coder", "unspecified commercial LLMs" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Backdoor SOMBERMEME deployed; Google reports.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the activity and tool use.", "summary": "The group used AI for personas and lures, Python RATs and Bash lateral-movement scripts.", "quote": "Used AI coding assistants such as DeepSeek-Coder to develop Python-based Remote Access Trojans", "sources": [ { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "date": "2026-09-08", "kind": "primary", "verified": true } ] }, { "id": "prc-cc-switch-pipeline-2026", "title": "PRC group chained Claude, Gemini and Codex into an exploitation pipeline", "date": "2026-09-08", "disclosed": "2026-09-08", "activity": "2026", "actor": "PRC-nexus espionage group (unnamed)", "actor_type": "nation-state", "nexus": "China", "targets": "Government entities", "ai_role": [ "exploit-dev", "phishing-content", "ops-automation" ], "models": [ "Claude", "Gemini", "Codex (via CC Switch)" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Google reports the pipeline under experimentation.", "confidence": "STRONG", "confidence_reason": "Google attributes with technical evidence from tooling, not provider telemetry for all models.", "summary": "The group used CC Switch to query several LLMs for custom exploit scripts, spear-phishing lures and debugging.", "quote": "the actor used the tool CC Switch to operate various LLMs, rapidly querying Claude, Gemini, or Codex to write custom exploit scripts, generate convincing spear-phishing lures, or debug errors", "sources": [ { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "date": "2026-09-08", "kind": "primary", "verified": true } ] }, { "id": "recon-agentic-credential-harvest-2026", "title": "Exposed 'Recon' framework used AI agents to harvest 23,800 secrets", "date": "2026-09-08", "disclosed": "2026-09-08", "activity": "2026", "actor": "Unattributed", "actor_type": "criminal", "nexus": null, "targets": "Server-side infrastructure; cloud and AI service keys", "ai_role": [ "agentic-intrusion", "vuln-research", "ops-automation" ], "models": [ "unspecified LLM agents (OpenClaw-style agent files)" ], "model_basis": "stated-by-vendor", "autonomy": "autonomous", "outcome": "Google disabled assets; over 23,800 secrets managed in the dashboard.", "confidence": "STRONG", "confidence_reason": "Google found agent config files and a dashboard on an exposed C2 server.", "summary": "Agent config files such as AGENTS.md and agentic_vuln_research.md showed AI agents researching vulnerabilities and exploiting servers with minimal human input.", "quote": "By leveraging autonomous AI agents to research vulnerabilities, scan server-side infrastructure, and execute targeted exploits", "sources": [ { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "date": "2026-09-08", "kind": "primary", "verified": true } ] }, { "id": "sandworm-relic-gemini-2026", "title": "SANDWORM RELIC integrated Gemini into operations against Ukraine", "date": "2026-09-08", "disclosed": "2026-09-08", "activity": "2026", "actor": "SANDWORM RELIC (APT44)", "actor_type": "nation-state", "nexus": "Russia", "targets": "Ukraine", "ai_role": [ "recon", "social-engineering", "ops-automation" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the activity.", "summary": "The group used Gemini for intelligence gathering, social engineering and workflow automation.", "quote": "has integrated Gemini to support intelligence gathering, social engineering, and workflow automation in continued operations targeting Ukraine", "sources": [ { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "date": "2026-09-08", "kind": "primary", "verified": true } ] }, { "id": "unc6240-shinyhunters-ai-2026", "title": "ShinyHunters cluster UNC6240 used AI across SaaS extortion attacks", "date": "2026-09-08", "disclosed": "2026-09-08", "activity": "2026", "actor": "UNC6240 (ShinyHunters)", "actor_type": "criminal", "nexus": null, "targets": "SaaS customers", "ai_role": [ "ops-automation", "data-analysis" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports.", "confidence": "CONFIRMED", "confidence_reason": "Google observed Gemini misuse mapped to the attack lifecycle.", "summary": "The extortion cluster used AI at several lifecycle stages of its SaaS data theft operations.", "quote": "has also integrated AI tactics across various stages of the attack lifecycle", "sources": [ { "title": "GTIG AI Threat Tracker: From Prompting to Autonomy", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai", "date": "2026-09-08", "kind": "primary", "verified": true } ] }, { "id": "unit42-ai-agents-ransomware-10-hours", "title": "AI agents execute full ransomware intrusion in under ten hours", "date": "2026-09", "disclosed": "2026-09-02", "actor": "Unidentified extortionist", "actor_type": "criminal", "nexus": null, "targets": "An enterprise network breached through an exposed API endpoint, then cloud, CI/CD and secrets manager", "ai_role": [ "agentic-intrusion", "recon", "ops-automation", "exploit-dev", "data-analysis" ], "models": [ "unspecified frontier models and agentic frameworks" ], "model_basis": "stated-by-researcher", "autonomy": "autonomous", "outcome": "Enterprise compromise in under 10 hours (responders estimate two weeks by hand); agent produced an 80-page audit of the victim's weaknesses.", "confidence": "CONFIRMED", "confidence_reason": "Unit 42 investigated the incident and reports the attacker told negotiators AI agents drove each step, with AI artifacts observed.", "summary": "A human directed AI agents that did recon, credential theft, cloud compromise and CI/CD hijacking across 50+ ATT&CK techniques. Only secondary coverage was fetched; the original Unit 42 page was not located.", "quote": "a human criminal delegated the entire operation to AI agents, compromising an enterprise network in under ten hours", "sources": [ { "title": "AI agents executed every step of this ransomware attack", "publisher": "Resultsense (via The Register, reporting Unit 42)", "url": "https://www.resultsense.com/news/2026-09-03-ai-agent-ransomware-unit42/", "date": "2026-09-03", "kind": "secondary", "verified": true } ] }, { "id": "eleven-nation-alert-dprk-realtime-deepfake-2026", "title": "Eleven nations warn DPRK IT workers use real-time deepfakes in interviews", "date": "2026-07-31", "disclosed": "2026-07-31", "activity": "2026", "actor": "North Korean IT workers", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Employers hiring remote staff", "ai_role": [ "deepfake", "social-engineering", "fraud" ], "models": [ "unspecified real-time face-swap tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Government alert; no single loss stated.", "confidence": "CONFIRMED", "confidence_reason": "Joint government advisory per TechTimes; I read only the secondary article, not the advisory.", "summary": "The US, Japan, South Korea, France, Germany, Italy and the Netherlands warned that operatives impersonate real people on live video interviews with manipulated feeds.", "quote": "North Korean IT Workers Use Real-Time Deepfakes to Beat Hiring Checks, Eleven Nations Warn", "sources": [ { "title": "North Korean IT Workers Use Real-Time Deepfakes to Beat Hiring Checks, Eleven Nations Warn", "publisher": "TechTimes", "url": "https://www.techtimes.com/articles/322688/20260802/north-korean-it-workers-use-real-time-deepfakes-beat-hiring-checks-eleven-nations-warn.htm", "date": "2026-08-02", "kind": "secondary", "verified": true } ] }, { "id": "cyberxero-claude-code-pentagi-iab", "title": "CyberXero initial access broker runs 51 Claude Code agents plus PentAGI", "date": "2026-07", "disclosed": "2026-10-06", "actor": "CyberXero", "actor_type": "criminal", "nexus": "Russia (medium confidence per SOCRadar)", "targets": "Ukrainian energy and utilities, plus mass WordPress/e-commerce scanning", "ai_role": [ "recon", "exploit-dev", "agentic-intrusion", "ops-automation", "evasion" ], "models": [ "Claude Code", "PentAGI via an AI provider API" ], "model_basis": "stated-by-researcher", "autonomy": "semi-autonomous", "outcome": "Data on 628,000+ Ukrainian individuals held; four organizations had confirmed exfiltration; no confirmed sale of access.", "confidence": "CONFIRMED", "confidence_reason": "SOCRadar analyzed an exposed open directory with agent configs and session logs documenting the AI use.", "summary": "The actor's workstation ran a swarm of 51 specialised Claude Code agents, and the team server wired PentAGI to Cobalt Strike. Logs record a fictional 'authorized pentest' narrative built to avoid model refusals; the Ukrainian campaign itself was largely manual.", "quote": "An AI orchestration layer: up to 51 specialized Claude Code agents on the primary workstation, plus a PentAGI deployment wired into a Cobalt Strike Team Server through an AI provider API", "sources": [ { "title": "CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure", "publisher": "SOCRadar", "url": "https://socradar.io/blog/cyberxero-ai-iab-ukraine-critical-infrastructure/", "date": "2026-10-06", "kind": "primary", "verified": true } ] }, { "id": "gambit-strix-cairn-hermes-retailer-skimmers", "title": "Open-source AI agents breach online retailers and plant card skimmers", "date": "2026-07", "disclosed": "2026-09-22", "actor": "Unnamed financially motivated operator", "actor_type": "criminal", "nexus": null, "targets": "Online retailers (at least 27 compromised; a US airline and hospitality firm among those named in coverage)", "ai_role": [ "vuln-research", "exploit-dev", "agentic-intrusion", "ops-automation", "fraud" ], "models": [ "Strix", "Cairn", "Hermes harnesses; per secondary coverage of the Gambit report the models included Claude Opus 4.6, DeepSeek V4 family and Z.ai GLM via OpenRouter (not re-verified on the fetched page)" ], "model_basis": "stated-by-researcher", "autonomy": "semi-autonomous", "outcome": "Over 600,000 payment card records reportedly stolen; skimmers installed on 100+ sites.", "confidence": "CONFIRMED", "confidence_reason": "Gambit recovered the operator's staging server and reconstructed the campaign, per press coverage.", "summary": "Three open-source agent harnesses discovered vulnerabilities, exploited them and coordinated jobs against hundreds of retailers at roughly $25 per target, with human prompts steering Hermes.", "quote": "The operation relied on three open-source AI harnesses working together with minimal manual input, including Strix, Cairn, and Hermes.", "sources": [ { "title": "Open-Source AI Agents Breach 27 Companies, Steal 600,000 Credit Card Records", "publisher": "Hackread (reporting Gambit Security)", "url": "https://hackread.com/open-source-ai-agents-breach-credit-card-records/", "date": "2026-09-22", "kind": "secondary", "verified": true } ] }, { "id": "symantec-skynet-llmjacking-offensive-agent", "title": "'Skynet' agent hijacks exposed LLM endpoints to power autonomous attacks", "date": "2026-07", "disclosed": "2026-10-21", "actor": "Unnamed operators", "actor_type": "criminal", "nexus": null, "targets": "Exposed LLM endpoints (honeypot) and internet-facing web frameworks", "ai_role": [ "llmjacking", "agentic-intrusion", "recon", "exploit-dev" ], "models": [ "unspecified commercial and exposed LLMs" ], "model_basis": "unknown", "autonomy": "autonomous", "outcome": "Agent designed to scan, exploit, steal credentials and install miners for up to 100,000 steps without approval; captured via honeypot.", "confidence": "CONFIRMED", "confidence_reason": "Symantec captured the full instruction set on an AI honeypot in summer 2026.", "summary": "Attackers wrap prompts in a jailbreak that frames credential theft as normal development work, then let a hijacked model drive scanning, exploitation and mining. The model owner pays for compute.", "quote": "Attackers have built an autonomous offensive agent that searches the internet for exposed large language model (LLM) endpoints and hijacks them", "sources": [ { "title": "Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run Attacks", "publisher": "Symantec (security.com)", "url": "https://www.security.com/threat-intelligence/ai-llmjacking-skynet", "date": "2026-10-21", "kind": "primary", "verified": true } ] }, { "id": "sysdig-vapt-ollama-reasoning-engine", "title": "Attacker uses someone else's exposed Ollama server as the brain of an offensive pipeline", "date": "2026-06-12", "disclosed": "2026-07-21", "actor": "Unnamed (VAPT framework)", "actor_type": "unknown", "nexus": null, "targets": "Victim's exposed Ollama server; probe targets were practice and lab ranges", "ai_role": [ "llmjacking", "agentic-intrusion", "exploit-dev" ], "models": [ "Ollama-hosted model (not named in the page I verified)" ], "model_basis": "unknown", "autonomy": "autonomous", "outcome": "Multi-stage automated scanning and exploit pipeline observed; no external victims confirmed.", "confidence": "CONFIRMED", "confidence_reason": "Sysdig captured the framework's prompts on its own sensor; details beyond the quoted line come from search snippets.", "summary": "Sysdig saw an attacker pivot through an unauthenticated Ollama server as the reasoning engine for an autonomous offensive tool. About 175,000 Ollama instances were estimated exposed.", "quote": "unauthenticated Ollama server as the reasoning engine to build an autonomous offensive tool", "sources": [ { "title": "Four ways AI has fundamentally changed the threat landscape in 2026", "publisher": "Sysdig", "url": "https://www.sysdig.com/blog/four-ways-ai-has-fundamentally-changed-the-threat-landscape-in-2026", "date": "2026-07-21", "kind": "primary", "verified": true } ] }, { "id": "huntress-vibe-coded-ad-enumeration", "title": "Vibe-coded PowerShell script maps Active Directory during intrusion", "date": "2026-06-03", "disclosed": "2026-07-08", "actor": "Unidentified", "actor_type": "unknown", "nexus": null, "targets": "Victim organization accessed via compromised remote credentials over RDP", "ai_role": [ "malware-dev", "recon" ], "models": [ "unspecified AI chatbot" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "AD users, computers, groups and trusts enumerated and zipped for exfiltration; s5cmd and SharpShares followed.", "confidence": "STRONG", "confidence_reason": "Huntress rebuilt the script from logs and cites chatbot-style title, unedited placeholder host and over-engineered fallbacks.", "summary": "During a live intrusion the actor ran a script titled as a finished chatbot debugging session, with a leftover placeholder hostname. Huntress argues behavior-based detection is needed because such scripts are unique each time.", "quote": "The script, enthusiastically titled \"100% Working AD Information Gathering Script - FULLY FIXED\"", "sources": [ { "title": "AI-Coded Malware: vibe coding Active Directory enumeration", "publisher": "Huntress", "url": "https://www.huntress.com/blog/ai-coded-malware-vibe-coding-active-directory", "date": "2026-07-08", "kind": "primary", "verified": true } ] }, { "id": "jadepuffer-agentic-ransomware-langflow", "title": "JadePuffer: LLM agent runs an entire extortion operation from Langflow exploit to data destruction", "date": "2026-06", "disclosed": "2026-07-02", "actor": "JadePuffer (Sysdig name)", "actor_type": "criminal", "nexus": null, "targets": "Internet-facing Langflow instance, then an exposed MySQL and Alibaba Nacos production server", "ai_role": [ "agentic-intrusion", "exploit-dev", "ops-automation" ], "models": [ "unspecified LLM" ], "model_basis": "unknown", "autonomy": "autonomous", "outcome": "1,342 Nacos configuration items encrypted with an unrecoverable ephemeral key; ransom note left; data not recoverable even if paid.", "confidence": "CONFIRMED", "confidence_reason": "Sysdig's analysis shows self-narrating LLM payloads; I verified it through The Register's report, not Sysdig's own page.", "summary": "Sysdig says an LLM, not a human, drove the intrusion: exploit CVE-2025-3248, steal credentials, persist, attack the database and encrypt. It retried failed steps in real time. Primary Sysdig URL was not verified.", "quote": "gained initial access to an internet-facing Langflow instance", "sources": [ { "title": "Smooth AI criminal drives 'first' end-to-end agentic ransomware attack", "publisher": "The Register", "url": "https://www.theregister.com/security/2026/07/02/smooth-ai-criminal-drives-first-end-to-end-agentic-ransomware-attack/5266073", "date": "2026-07-02", "kind": "secondary", "verified": true } ] }, { "id": "apt27-gemini-orb-fleet-tool", "title": "APT27 uses Gemini to build relay-network management tool", "date": "2026-05-11", "disclosed": "2026-05-11", "activity": "2026", "actor": "APT27", "actor_type": "nation-state", "nexus": "China", "targets": "Own operational relay box (ORB) infrastructure", "ai_role": [ "malware-dev", "evasion" ], "models": [ "Google Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Tooling to manage a 3-hop ORB anonymization network supporting intrusion activity.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the activity in its own Gemini service.", "summary": "GTIG saw APT27 use Gemini to speed development of a fleet-management app for an ORB network using mobile and router devices. It supports hiding intrusion origin rather than attacking a victim directly.", "quote": "APT27, which has leveraged Gemini to accelerate the development of a fleet management application", "sources": [ { "title": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "date": "2026-05-11", "kind": "primary", "verified": true } ] }, { "id": "apt45-unc2814-gemini-vuln-research", "title": "DPRK and PRC clusters use Gemini and agent tools for scaled vulnerability research", "date": "2026-05-11", "disclosed": "2026-05-11", "activity": "2026", "actor": "APT45; UNC2814", "actor_type": "nation-state", "nexus": "North Korea (APT45); PRC-associated (UNC2814)", "targets": "Embedded devices (TP-Link firmware, OFTP implementations) and CVE/PoC validation", "ai_role": [ "vuln-research", "exploit-dev" ], "models": [ "Google Gemini", "OpenClaw", "OneClaw", "wooyun-legacy Claude Code skill" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Accounts disrupted; GTIG reports sustained AI-augmented exploit research, no specific victim named.", "confidence": "CONFIRMED", "confidence_reason": "Google, the model provider, observed the prompts in Gemini.", "summary": "GTIG observed APT45 sending thousands of repetitive prompts to analyze CVEs and validate PoC exploits, and UNC2814 using expert-persona jailbreaks for router and firmware research. Actors also experimented with agentic tools OpenClaw and OneClaw. Date is the report date, not an incident date.", "quote": "we have observed APT45 sending thousands of repetitive prompts that recursively analyze different CVEs and validate PoC exploits", "sources": [ { "title": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "date": "2026-05-11", "kind": "primary", "verified": true } ] }, { "id": "canfail-longstream-russia-ukraine", "title": "Russia-nexus malware with LLM-generated decoy code targets Ukraine", "date": "2026-05-11", "disclosed": "2026-05-11", "activity": "2026", "actor": "Suspected Russia-nexus actors", "actor_type": "nation-state", "nexus": "Russia", "targets": "Ukrainian organizations", "ai_role": [ "malware-dev", "evasion" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "CANFAIL and LONGSTREAM delivered with AI-generated decoy logic to hamper analysis.", "confidence": "STRONG", "confidence_reason": "GTIG found leftover developer (LLM) comments in the code but names no model.", "summary": "GTIG confirms the use of CANFAIL and LONGSTREAM, whose decoy code is LLM generated. The decoy code pads the malware with benign-looking activity. Date shown is the report month.", "quote": "Analysis confirms the use of CANFAIL and LONGSTREAM, which utilize LLM-generated decoy code to obfuscate their malicious functionality.", "sources": [ { "title": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "date": "2026-05-11", "kind": "primary", "verified": true } ] }, { "id": "promptspy-android-gemini-agent", "title": "PROMPTSPY Android backdoor drives the phone UI through Gemini", "date": "2026-05-11", "disclosed": "2026-05-11", "activity": "2026", "actor": "Unnamed", "actor_type": "unknown", "nexus": null, "targets": "Android users", "ai_role": [ "malware-runtime-llm", "agentic-intrusion", "evasion" ], "models": [ "Google gemini-2.5-flash-lite", "Google Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "autonomous", "outcome": "Malware sends the screen's UI hierarchy to Gemini and executes returned click and swipe actions.", "confidence": "CONFIRMED", "confidence_reason": "GTIG reverse engineered the malware and found the hardcoded Gemini prompt and model name.", "summary": "ESET first identified PROMPTSPY; GTIG found a GeminiAutomationAgent module that lets an LLM decide gestures from the live UI state. Date shown is the GTIG report month; first-seen date was not verified.", "quote": "PROMPTSPY, an Android backdoor first identified by ESET", "sources": [ { "title": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "date": "2026-05-11", "kind": "primary", "verified": true }, { "title": "PromptSpy ushers in the era of Android threats using GenAI", "publisher": "ESET (WeLiveSecurity)", "url": "https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/", "date": "2026-02-19", "kind": "primary", "verified": true } ] }, { "id": "gtig-ai-built-2fa-bypass-zero-day", "title": "Criminals build 2FA-bypass zero-day with AI for planned mass exploitation", "date": "2026-05", "disclosed": "2026-05-11", "actor": "Unnamed prominent cybercrime actors", "actor_type": "criminal", "nexus": null, "targets": "Popular open-source web-based system administration tool (unnamed)", "ai_role": [ "vuln-research", "exploit-dev" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "Exploit disrupted before the planned mass exploitation; vendor notified.", "confidence": "STRONG", "confidence_reason": "GTIG assesses LLM authorship with high confidence from artifacts such as a hallucinated CVSS score; no model is named.", "summary": "GTIG found a Python zero-day exploit that bypasses 2FA via a hardcoded trust assumption and believes an AI model helped find and weaponize it. It is GTIG's first identified AI-developed zero-day. Google does not name the group or the product.", "quote": "For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.", "sources": [ { "title": "GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access", "date": "2026-05-11", "kind": "primary", "verified": true }, { "title": "AI risk and resilience in 2026: A Mandiant special report", "publisher": "Mandiant / Google Cloud", "url": "https://cloud.google.com/security/resources/ai-risk-and-resilience-2026", "date": "2026-09-15", "kind": "primary", "verified": true } ] }, { "id": "gtg-15001-ai-dating-app-scam-2026", "title": "China-based studio ran 20+ dating apps with AI personas to defraud users", "date": "2026-04", "disclosed": "2026-09-10", "actor": "GTG-15001", "actor_type": "criminal", "nexus": "China", "targets": "Dating app users", "ai_role": [ "fraud", "social-engineering" ], "models": [ "Claude", "image-editing model", "other AI providers" ], "model_basis": "stated-by-vendor", "autonomy": "autonomous", "outcome": "4,700+ AI personas, 25,000+ users in two weeks; accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic reports from its own investigation.", "summary": "Claude built the apps and powered about 2.36M persona messages.", "quote": "A China-based app studio used Claude to both build a network of over 20 dating apps and power the AI personas used to converse with users", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "gtg-50029-european-hacktivist-2026", "title": "A hacktivist used Claude to breach European political entities", "date": "2026-04", "disclosed": "2026-09-10", "actor": "GTG-50029", "actor_type": "hacktivist", "nexus": null, "targets": "European political parties, media, think tanks and their SaaS providers", "ai_role": [ "exploit-dev", "agentic-intrusion", "malware-dev", "data-analysis", "recon", "llmjacking" ], "models": [ "Claude", "other AI models for vetting findings" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Access to at least 14 of 42 targets; 12-26 GB leaked or staged; accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic reports from its own investigation.", "summary": "A lone actor used Claude sub-agents to build a WordPress exploit and a doxxing search engine.", "quote": "The actor used Claude to develop and debug the exploit in the same session, including creating a lab harness.", "sources": [ { "title": "Detecting and countering misuse of AI: September 2026", "publisher": "Anthropic", "url": "https://www.anthropic.com/threat-intelligence-report-september-2026", "date": "2026-09-10", "kind": "primary", "verified": true } ] }, { "id": "apt36-vibeware", "title": "APT36 mass-produces 'vibeware' implants with AI tools", "date": "2026-03", "disclosed": "2026-03-06", "actor": "APT36 / Transparent Tribe", "actor_type": "nation-state", "nexus": "Pakistan", "targets": "Indian government networks and related entities", "ai_role": [ "malware-dev", "evasion", "ops-automation" ], "models": [ "unspecified LLMs and AI coding tools" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "High volume of disposable, often low-quality implants in Nim, Zig, Crystal, Rust and Go using Slack, Discord, Google Sheets and Supabase for C2.", "confidence": "STRONG", "confidence_reason": "Bitdefender links the campaign to APT36 with medium confidence and attributes AI-assisted generation; direct fetch of the page was blocked (403) so claims rest on search-result summaries.", "summary": "Bitdefender describes an AI-assisted malware assembly line producing many variants in niche languages to overwhelm signature detection. Code quality was often poor, with missing C2 addresses.", "quote": "AI-assisted malware industrialisation that allows the actor to flood target environments with disposable, polyglot binaries", "sources": [ { "title": "Nation-State Actor Embraces AI Malware Assembly Line", "publisher": "Dark Reading (reporting Bitdefender 'APT36: A Nightmare of Vibeware')", "url": "https://www.darkreading.com/cyberattacks-data-breaches/nation-state-actor-ai-malware-assembly-line", "date": "2026-03-06", "kind": "secondary", "verified": false } ] }, { "id": "fideuram-intesa-voice-clone-95m-2026", "title": "Fideuram chairman tricked by cloned voice and fake CEO messages into EUR 95M transfers", "date": "2026-02-23", "disclosed": "2026-09-25", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Fideuram - Intesa Sanpaolo Private Banking", "ai_role": [ "deepfake", "fraud", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "About EUR 95M sent overseas; about EUR 53M recovered, EUR 36M converted to crypto and untraced.", "confidence": "STRONG", "confidence_reason": "Reuters-based reporting says investigators believe a lawyer's voice was AI-cloned; video use is not established.", "summary": "A WhatsApp message posing as the Intesa CEO about a secret acquisition was followed by a call in the cloned voice of a known lawyer. Milan prosecutors and Eurojust are investigating; the disclosure date is approximate.", "quote": "AI Voice-Cloning Scam Hits Italian Bank: Fake Executives Trick Fideuram Into EUR 95 Million Overseas Transfers", "sources": [ { "title": "AI Voice-Cloning Scam Hits Italian Bank", "publisher": "Gulf News", "url": "https://gulfnews.com/world/europe/ai-voice-cloning-scam-hits-italian-bank-fake-executives-trigger-95m-overseas-transfers-1.500688692", "date": "2026-09-25", "kind": "secondary", "verified": true } ] }, { "id": "apt31-hexstrike-gemini-2026", "title": "APT31 drove Gemini with Hexstrike MCP tooling against US targets", "date": "2026-02-12", "disclosed": "2026-02-12", "activity": "2025", "actor": "APT31", "actor_type": "nation-state", "nexus": "China", "targets": "US-based targets", "ai_role": [ "vuln-research", "exploit-dev", "ops-automation" ], "models": [ "Gemini", "Hexstrike MCP" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Google reports; outcome not stated.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the prompting directly.", "summary": "APT31 gave Gemini an expert persona and used it to analyze RCE, WAF bypass and SQL injection test results against named US targets.", "quote": "trialing Hexstrike MCP tooling, and directing the model to analyze remote code execution (RCE), web application firewall (WAF) bypass techniques, and SQL injection test results against specific US-based targets", "sources": [ { "title": "GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use", "date": "2026-02-12", "kind": "primary", "verified": true } ] }, { "id": "slopoly-hive0163-ransomware", "title": "Slopoly: likely AI-generated PowerShell backdoor in Hive0163 ransomware attack", "date": "2026-02", "disclosed": "2026-03-12", "actor": "Hive0163", "actor_type": "criminal", "nexus": null, "targets": "Enterprise victim of ClickFix-initiated ransomware intrusion", "ai_role": [ "malware-dev" ], "models": [ "unspecified LLM" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "Backdoor gave persistent access for more than a week during a ransomware engagement.", "confidence": "STRONG", "confidence_reason": "IBM X-Force infers AI generation from comments and code style and could not identify the model.", "summary": "X-Force found a technically mediocre PowerShell C2 client during a live ransomware response, with clear variable names and detailed comments that looked machine-written. They say it shows AI speeding up malware development.", "quote": "IBM X-Force discovered a likely AI-generated novel malware which we are dubbing “Slopoly,” used during a ransomware attack.", "sources": [ { "title": "A Slopoly start to AI-enhanced ransomware attacks", "publisher": "IBM X-Force", "url": "https://www.ibm.com/think/x-force/slopoly-start-ai-enhanced-ransomware-attacks", "date": "2026-03-12", "kind": "primary", "verified": true } ] }, { "id": "uat-10147-pentestgpt-deepaudit", "title": "UAT-10147 uses PentestGPT, DeepAudit and AI-written scripts against web servers", "date": "2026-02", "disclosed": "2026-08-20", "actor": "UAT-10147", "actor_type": "criminal", "nexus": "China (Chinese-speaking)", "targets": "About 170,000 target URLs; Windows and Linux web servers worldwide (Brazil, Bolivia, China, Canada, Vietnam seen)", "ai_role": [ "recon", "exploit-dev", "ops-automation", "agentic-intrusion", "malware-dev" ], "models": [ "PentestGPT", "DeepAudit" ], "model_basis": "stated-by-researcher", "autonomy": "semi-autonomous", "outcome": "Mass exploitation, SPECTRE backdoor deployment, SEO fraud and data theft.", "confidence": "CONFIRMED", "confidence_reason": "Talos recovered the tools and AI-generated scripts from an exposed attacker download server.", "summary": "Talos found the actor running PentestGPT and DeepAudit to scan servers and run matching exploits, plus AI-generated Python scripts automating an ASP.NET ViewState RCE chain. A companion report says AI helped write a Linux rootkit.", "quote": "The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to automate intrusion operations and establish persistence.", "sources": [ { "title": "UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations", "publisher": "Cisco Talos", "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "date": "2026-08-20", "kind": "primary", "verified": true } ] }, { "id": "unc1069-deepfake-zoom-crypto-fintech-2026", "title": "UNC1069 hits crypto fintech with fake Zoom and apparent deepfake CEO video", "date": "2026-01", "disclosed": "2026-02-09", "actor": "UNC1069 (CryptoCore / MASAN)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Cryptocurrency fintech and Web3 firms, macOS host", "ai_role": [ "deepfake", "social-engineering", "phishing-content" ], "models": [ "unspecified voice-clone/deepfake tool", "Gemini" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Seven malware families found on a macOS host.", "confidence": "STRONG", "confidence_reason": "Mandiant reports the victim saw an apparent deepfake CEO but could not forensically verify AI model use in that case; it separately reports the group's AI use.", "summary": "Telegram contact from a compromised executive account led to a spoofed Zoom with an apparent deepfake CEO and a ClickFix lure. Mandiant says the group also uses AI for lure material.", "quote": "a video of a CEO from another cryptocurrency company that appeared to be a deepfake", "sources": [ { "title": "UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering", "publisher": "Google Cloud / Mandiant", "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering", "date": "2026-02-09", "kind": "primary", "verified": true }, { "title": "North Korea's UNC1069 Hammers Crypto Firms With AI", "publisher": "Dark Reading", "url": "https://www.darkreading.com/threat-intelligence/north-koreas-unc1069-hammers-crypto-firms", "date": "2026-02-11", "kind": "secondary", "verified": true } ] }, { "id": "mexico-government-claude-code-breach", "title": "Hacker uses Claude Code and GPT-4.1 to breach nine Mexican government bodies", "date": "2025-12", "disclosed": "2026-02-24", "actor": "Unnamed single operator", "actor_type": "unknown", "nexus": null, "targets": "Nine Mexican federal, state and municipal organizations incl. tax authority SAT and electoral institute INE", "ai_role": [ "recon", "exploit-dev", "agentic-intrusion", "data-analysis", "ops-automation" ], "models": [ "Claude Code", "OpenAI GPT-4.1" ], "model_basis": "stated-by-researcher", "autonomy": "semi-autonomous", "outcome": "About 150 GB of citizen and tax data stolen; Gambit reports ~195 million identities exposed. Mexico's SAT has disputed some of Gambit's findings.", "confidence": "CONFIRMED", "confidence_reason": "Gambit Security recovered the attacker's exposed Claude conversations and reports the AI's share of command execution.", "summary": "A single operator ran Claude Code against Mexican government networks from late December 2025 to mid-February 2026 after jailbreaking it with a bug-bounty framing. Claude Code generated and executed about 75 percent of remote commands, while GPT-4.1 turned stolen server data into thousands of intelligence reports. Gambit calls it a human-directed hybrid operation.", "quote": "Approximately 75 percent of remote command execution activity across the campaign was generated and executed by Claude Code via its tool-use interface.", "sources": [ { "title": "The AI-Assisted Breach of Mexico's Government Infrastructure (technical report)", "publisher": "Gambit Security", "url": "https://gambit.security/ai-assisted-breach-of-mexicos-government-infrastructure", "date": "2026-04-10", "kind": "primary", "verified": true }, { "title": "Hacker used Anthropic's Claude chatbot to attack multiple government agencies in Mexico", "publisher": "Engadget", "url": "https://www.engadget.com/ai/hacker-used-anthropics-claude-chatbot-to-attack-multiple-government-agencies-in-mexico-171237255.html", "date": "2026-02-25", "kind": "secondary", "verified": true } ] }, { "id": "sysdig-ai-assisted-aws-admin-8-minutes", "title": "AI-assisted AWS intrusion reaches admin in under 10 minutes", "date": "2025-11-28", "disclosed": "2026-02-03", "actor": "Unnamed actor (Serbian-language comments in injected code)", "actor_type": "unknown", "nexus": null, "targets": "One AWS customer environment (RAG data buckets, Lambda, Bedrock)", "ai_role": [ "recon", "exploit-dev", "ops-automation", "llmjacking", "agentic-intrusion", "fraud" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "semi-autonomous", "outcome": "Admin privileges in ~8 minutes, 19 AWS principals compromised, Bedrock models and GPU instances abused.", "confidence": "STRONG", "confidence_reason": "Sysdig infers LLM use from code style, comments and hallucinated artifacts; no model is identified.", "summary": "Credentials from public S3 buckets led to Lambda code injection and rapid privilege escalation. Sysdig sees multiple signs that LLMs generated code and made real-time decisions. The attacker also invoked Bedrock models on the victim's bill.", "quote": "multiple indicators that suggest the threat actor leveraged large language models (LLMs) throughout the operation", "sources": [ { "title": "AI-assisted cloud intrusion achieves admin access in 8 minutes", "publisher": "Sysdig", "url": "https://www.sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes", "date": "2026-02-03", "kind": "primary", "verified": true } ] }, { "id": "quietvault-ai-credential-stealer-2025", "title": "QUIETVAULT stealer used on-host AI CLI tools to hunt secrets", "date": "2025-11-05", "disclosed": "2025-11-05", "activity": "2025", "actor": "Unattributed", "actor_type": "criminal", "nexus": null, "targets": "GitHub and NPM token holders", "ai_role": [ "malware-runtime-llm" ], "models": [ "unspecified LLM (on-host AI CLI tools)" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Observed in operations per Google.", "confidence": "STRONG", "confidence_reason": "Google's malware analysis shows an AI prompt and AI CLI tools in the stealer; no provider telemetry.", "summary": "A JavaScript stealer for GitHub and NPM tokens used an AI prompt and installed AI CLI tools to look for other secrets and exfiltrate them to GitHub.", "quote": "QUIETVAULT leverages an AI prompt and on-host installed AI CLI tools to search for other potential secrets on the infected system", "sources": [ { "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "date": "2025-11-05", "kind": "primary", "verified": true } ] }, { "id": "temp-zagros-gemini-malware-2025", "title": "TEMP.Zagros used Gemini to research custom malware", "date": "2025-11-05", "disclosed": "2025-11-05", "activity": "2025", "actor": "TEMP.Zagros (MuddyWater)", "actor_type": "nation-state", "nexus": "Iran", "targets": "Phishing victims", "ai_role": [ "malware-dev" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports; no breach detail.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the Gemini use directly.", "summary": "The group used Gemini to support development of custom malware including web shells and a Python C2 server.", "quote": "used Gemini to conduct research to support the development of custom malware", "sources": [ { "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "date": "2025-11-05", "kind": "primary", "verified": true } ] }, { "id": "unc1069-masan-gemini-crypto-2025", "title": "North Korean UNC1069 used Gemini and deepfake lures for crypto theft", "date": "2025-11-05", "disclosed": "2025-11-05", "activity": "2025", "actor": "UNC1069 (MASAN)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Cryptocurrency users and industry", "ai_role": [ "recon", "malware-dev", "deepfake", "social-engineering" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Account disabled.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the Gemini misuse and the deepfake lures.", "summary": "The group used Gemini for wallet-data research and code to steal crypto, wrote fake update prompts, and used deepfake lures to spread a backdoor.", "quote": "UNC1069 attempted to misuse Gemini to develop code to steal cryptocurrency, as well as to craft fraudulent instructions impersonating a software update to extract user credentials.", "sources": [ { "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "date": "2025-11-05", "kind": "primary", "verified": true } ] }, { "id": "unc4899-pukchong-gemini-2025", "title": "UNC4899 used Gemini for exploit research and tooling", "date": "2025-11-05", "disclosed": "2025-11-05", "activity": "2025", "actor": "UNC4899 (PUKCHONG)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Edge devices and browsers (likely)", "ai_role": [ "exploit-dev", "vuln-research", "malware-dev" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Accounts disabled.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the Gemini use directly.", "summary": "The supply-chain-focused group used Gemini to write code, research exploits and improve tooling.", "quote": "used Gemini for a variety of purposes including developing code, researching exploits, and improving their tooling", "sources": [ { "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "date": "2025-11-05", "kind": "primary", "verified": true } ] }, { "id": "coinbait-ai-phishing-kit-2025", "title": "COINBAIT crypto-exchange phishing kit built with AI code generation", "date": "2025-11", "disclosed": "2026-02-12", "actor": "UNC5356 overlap", "actor_type": "criminal", "nexus": null, "targets": "Cryptocurrency exchange users", "ai_role": [ "phishing-content", "malware-dev" ], "models": [ "unspecified LLM (AI code generation tools)" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Kit identified Nov 2025.", "confidence": "STRONG", "confidence_reason": "Google infers AI use from source code artifacts and gives high-confidence infrastructure overlap, not provider telemetry.", "summary": "The phishing kit mimicked a major exchange for credential harvesting and was likely accelerated by AI coding tools.", "quote": "a phishing kit, whose construction was likely accelerated by AI code generation tools", "sources": [ { "title": "GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use", "date": "2026-02-12", "kind": "primary", "verified": true } ] }, { "id": "voidlink-ai-built-linux-malware-framework", "title": "VoidLink: advanced Linux cloud malware framework built almost entirely by AI", "date": "2025-11", "disclosed": "2026-01-20", "actor": "Unnamed single developer", "actor_type": "unknown", "nexus": "China", "targets": "Cloud workloads on AWS, GCP, Azure, Alibaba, Tencent; Docker/Kubernetes", "ai_role": [ "malware-dev", "evasion" ], "models": [ "TRAE SOLO (AI assistant in the TRAE IDE)" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Framework with implants, rootkit evasion and dozens of plugins; first functional implant reportedly within a week; in-progress, not confirmed deployed at scale.", "confidence": "CONFIRMED", "confidence_reason": "Check Point recovered AI-generated planning and helper files left by the developer's own OPSEC failure; Elastic independently corroborated.", "summary": "Leaked TRAE-generated helper files showed one developer used spec-driven development with an AI assistant to produce a Zig-based C2 framework. Check Point called it the first well-documented advanced malware written mostly by AI.", "quote": "VoidLink’s development likely began in late November 2025, when its developer turned to TRAE SOLO, an AI assistant embedded in TRAE , an AI-centric IDE.", "sources": [ { "title": "VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun", "publisher": "Check Point Research", "url": "https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/", "date": "2026-01-20", "kind": "primary", "verified": true }, { "title": "An AI wrote VoidLink, the cloud-targeting Linux malware", "publisher": "The Register", "url": "https://www.theregister.com/security/2026/01/20/an-ai-wrote-voidlink-the-cloud-targeting-linux-malware/5098300", "date": "2026-01-20", "kind": "secondary", "verified": true } ] }, { "id": "openai-korean-operators-xenorat-2025", "title": "Korean-language operators sought ChatGPT help for malware and C2", "date": "2025-10-07", "disclosed": "2025-10-07", "activity": "2025", "actor": "Korean-language operator cluster (overlaps Trellix reporting)", "actor_type": "unknown", "nexus": "North Korea (suspected)", "targets": "South Korean diplomatic missions", "ai_role": [ "malware-dev", "phishing-content" ], "models": [ "ChatGPT" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Accounts banned; OpenAI could not independently attribute.", "confidence": "STRONG", "confidence_reason": "OpenAI banned the accounts but does not independently attribute to DPRK.", "summary": "The cluster used ChatGPT for malware and C2 development and Korean phishing drafts, overlapping Trellix reporting on XenoRAT.", "quote": "operators attempted to use our models to engage in malware and command-and-control (C2) development", "sources": [ { "title": "Disrupting malicious uses of AI: October 2025 (report PDF)", "publisher": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf", "date": "2025-10-07", "kind": "primary", "verified": true } ] }, { "id": "openai-russian-malware-tooling-2025", "title": "Russian-speaking criminals vibe-coded RAT and stealers with ChatGPT", "date": "2025-10-07", "disclosed": "2025-10-07", "activity": "2025", "actor": "Russian-speaking criminal operator", "actor_type": "criminal", "nexus": "Russia", "targets": "Unspecified", "ai_role": [ "malware-dev", "evasion" ], "models": [ "ChatGPT" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI states it banned the accounts and cites Telegram evidence.", "summary": "The operator used ChatGPT accounts to prototype and fix post-exploitation and credential-theft components.", "quote": "accounts that were attempting to use the model to help develop and refine malware, including a remote‑access trojan, credential stealers, and features to evade detection", "sources": [ { "title": "Disrupting malicious uses of AI: October 2025 (report PDF)", "publisher": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf", "date": "2025-10-07", "kind": "primary", "verified": true } ] }, { "id": "openai-unk-droppitch-2025", "title": "UNK_DROPPITCH/UTA0388 operators used ChatGPT for phishing and tools", "date": "2025-10-07", "disclosed": "2025-10-07", "activity": "2025", "actor": "UNK_DROPPITCH / UTA0388", "actor_type": "nation-state", "nexus": "China", "targets": "Taiwan semiconductors, US academia and think tanks", "ai_role": [ "phishing-content", "malware-dev" ], "models": [ "ChatGPT" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI ties accounts to public Proofpoint and Volexity reporting.", "summary": "The operators used ChatGPT to write multilingual phishing content and debug tooling.", "quote": "especially crafting phishing content and debugging or modifying their tooling", "sources": [ { "title": "Disrupting malicious uses of AI: October 2025 (report PDF)", "publisher": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/7d662b68-952f-4dfd-a2f2-fe55b041cc4a/disrupting-malicious-uses-of-ai-october-2025.pdf", "date": "2025-10-07", "kind": "primary", "verified": true } ] }, { "id": "shai-hulud-npm-worm-llm-script", "title": "Shai-Hulud npm worm: malicious bash script likely LLM-generated", "date": "2025-09-14", "disclosed": "2025-09-15", "actor": "Unknown (Shai-Hulud)", "actor_type": "unknown", "nexus": null, "targets": "npm maintainers and packages, wide ecosystem", "ai_role": [ "malware-dev", "supply-chain" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "Self-replicating worm stole credentials and republished infected packages.", "confidence": "STRONG", "confidence_reason": "Unit 42 assesses LLM use with moderate confidence from comments and emojis in the script.", "summary": "Unit 42 judged that the worm's bash payload was written with LLM help, based on stylistic artifacts. It framed the worm as following s1ngularity's weaponization of AI tools.", "quote": "Unit 42 also assesses with moderate confidence that an LLM was used to generate the malicious bash script, based on inclusion of comments and emojis.", "sources": [ { "title": "Shai-Hulud Worm Compromises npm Ecosystem in Supply Chain Attack", "publisher": "Unit 42, Palo Alto Networks", "url": "https://unit42.paloaltonetworks.com/npm-supply-chain-attack/", "date": "2025-09-17", "kind": "primary", "verified": true } ] }, { "id": "gtg-1002-claude-code-espionage-2025", "title": "Chinese state group ran largely autonomous espionage campaign via Claude Code", "date": "2025-09", "disclosed": "2025-11-13", "actor": "Chinese state-sponsored group (Anthropic: GTG-1002)", "actor_type": "nation-state", "nexus": "China", "targets": "About thirty targets: tech companies, financial institutions, chemical manufacturers, government agencies", "ai_role": [ "recon", "agentic-intrusion", "exploit-dev", "data-analysis", "ops-automation" ], "models": [ "Claude Code" ], "model_basis": "stated-by-vendor", "autonomy": "autonomous", "outcome": "A small number of intrusions succeeded; accounts banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic detected and disrupted the campaign and reports its details.", "summary": "Operators built a framework that drove Claude Code through reconnaissance, exploitation, credential theft and exfiltration, with humans approving only a few decision points.", "quote": "the threat actor was able to use AI to perform 80-90% of the campaign, with human intervention required only sporadically", "sources": [ { "title": "Disrupting the first reported AI-orchestrated cyber espionage campaign", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/disrupting-AI-espionage", "date": "2025-11-13", "kind": "primary", "verified": true } ] }, { "id": "hexstrike-ai-citrix-netscaler-chatter", "title": "Criminals discuss weaponizing HexStrike AI against Citrix NetScaler zero-days", "date": "2025-09", "disclosed": "2025-09-03", "actor": "Underground forum actors (later attributed in press to Storm-1575)", "actor_type": "criminal", "nexus": null, "targets": "Citrix NetScaler ADC/Gateway (CVE-2025-7775, -7776, -8424)", "ai_role": [ "vuln-research", "exploit-dev", "agentic-intrusion", "ops-automation" ], "models": [ "unspecified LLMs via HexStrike AI MCP server" ], "model_basis": "unknown", "autonomy": "semi-autonomous", "outcome": "Forum claims of exploitation and sale of compromised appliances; Check Point said it lacked proof of use in attacks at publication.", "confidence": "SUSPECTED", "confidence_reason": "Check Point reports underground discussion and claims, not confirmed attack telemetry; the Storm-1575 attribution appears only in later secondary coverage.", "summary": "Within hours of HexStrike AI's release, underground channels discussed using it against freshly disclosed Citrix zero-days. The framework connects LLMs to 150+ security tools through MCP.", "quote": "malicious actors began discussing how to weaponize it", "sources": [ { "title": "Hexstrike-AI: When LLMs Meet Zero-Day Exploitation", "publisher": "Check Point", "url": "https://blog.checkpoint.com/executive-insights/hexstrike-ai-when-llms-meet-zero-day-exploitation/", "date": "2025-09-03", "kind": "primary", "verified": true }, { "title": "Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure", "publisher": "The Hacker News", "url": "https://thehackernews.com/2025/09/threat-actors-weaponize-hexstrike-ai-to.html", "date": "2025-09-03", "kind": "secondary", "verified": true } ] }, { "id": "honestcue-gemini-downloader-2025", "title": "HONESTCUE malware outsourced stage-two code generation to Gemini", "date": "2025-09", "disclosed": "2026-02-12", "actor": "Unattributed", "actor_type": "unknown", "nexus": null, "targets": "Unspecified", "ai_role": [ "malware-runtime-llm", "evasion" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Samples observed Sept 2025.", "confidence": "CONFIRMED", "confidence_reason": "Google analyzed the samples.", "summary": "A downloader sent hard-coded prompts to the Gemini API and ran the returned C# to fetch and execute a second-stage payload.", "quote": "HONESTCUE is a downloader and launcher framework that sends a prompt via Google Gemini's API and receives C# source code as the response.", "sources": [ { "title": "GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use", "date": "2026-02-12", "kind": "primary", "verified": true } ] }, { "id": "evilai-fake-apps-ai-generated-code", "title": "EvilAI: fake productivity apps built with AI-generated code", "date": "2025-08-29", "disclosed": "2025-09-10", "actor": "EvilAI operators", "actor_type": "criminal", "nexus": null, "targets": "Organizations worldwide; manufacturing, government, healthcare", "ai_role": [ "malware-dev", "evasion" ], "models": [ "unspecified AI tools" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "Signed trojanized apps stole browser data and acted as a stager; 100+ incidents in first week of telemetry.", "confidence": "STRONG", "confidence_reason": "Trend Micro attributes AI-generated code from artifacts; no model named.", "summary": "Operators distributed working but trojanized apps with valid certificates, with code that Trend says was AI-generated and hard for static scanners to flag. Later vendor reporting says activity continued into 2026.", "quote": "Combining AI-generated code and social engineering, EvilAI operators are executing a rapidly expanding campaign", "sources": [ { "title": "EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks", "publisher": "Trend Micro", "url": "https://www.trendmicro.com/en_us/research/25/i/evilai.html", "date": "2025-09-10", "kind": "primary", "verified": true } ] }, { "id": "s1ngularity-nx-ai-cli-weaponized", "title": "s1ngularity: Nx npm compromise runs victims' AI CLIs to hunt secrets", "date": "2025-08-26", "disclosed": "2025-08-27", "actor": "Unknown (s1ngularity)", "actor_type": "unknown", "nexus": null, "targets": "Developers installing malicious Nx npm versions; thousands of GitHub accounts", "ai_role": [ "supply-chain", "agentic-intrusion", "recon" ], "models": [ "Claude Code CLI", "Gemini CLI", "Amazon Q CLI" ], "model_basis": "stated-by-researcher", "autonomy": "semi-autonomous", "outcome": "Credentials, tokens, SSH keys and wallets stolen and posted to public GitHub repos; malicious versions live about five hours.", "confidence": "CONFIRMED", "confidence_reason": "Malware code itself invokes the installed AI CLIs with permission-bypass flags and a recon prompt.", "summary": "A malicious postinstall script checked for Claude Code, Gemini CLI and Q, and ran them with approval prompts disabled. The prompt told each agent to find secret and wallet files and write the paths to an inventory file, which the malware then exfiltrated.", "quote": "The script prompts these tools with dangerous flags: --dangerously-skip-permissions --yolo --trust-all-tools", "sources": [ { "title": "s1ngularity: Popular Nx Build System Package Compromised with Data-Stealing Malware", "publisher": "StepSecurity", "url": "https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware", "date": "2025-08-27", "kind": "primary", "verified": true } ] }, { "id": "ms-ai-obfuscated-svg-phishing", "title": "Credential phishing campaign with LLM-obfuscated SVG payload", "date": "2025-08-18", "disclosed": "2025-09-24", "actor": "Unnamed", "actor_type": "criminal", "nexus": null, "targets": "Mostly US organizations, via compromised small-business email account", "ai_role": [ "phishing-content", "evasion", "malware-dev" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "Blocked by Microsoft Defender for Office 365.", "confidence": "STRONG", "confidence_reason": "Microsoft's analysis (using Security Copilot) judged the obfuscation likely AI-generated; inference from code artifacts.", "summary": "Phishing emails carried an SVG disguised as a PDF whose JavaScript was obfuscated with business-vocabulary attributes. Microsoft assessed the code was unlikely to be hand-written.", "quote": "not something a human would typically write from scratch due to its complexity, verbosity, and lack of practical utility.", "sources": [ { "title": "AI vs. AI: Detecting an AI-obfuscated phishing campaign", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2025/09/24/ai-vs-ai-detecting-an-ai-obfuscated-phishing-campaign/", "date": "2025-09-24", "kind": "primary", "verified": true } ] }, { "id": "crowdstrike-famous-chollima-deepfake-2025", "title": "CrowdStrike: Famous Chollima uses real-time deepfakes and GenAI at 320+ companies", "date": "2025-08-04", "disclosed": "2025-08-04", "activity": "2024-2025", "actor": "Famous Chollima", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Hundreds of companies hiring remote IT workers", "ai_role": [ "deepfake", "social-engineering", "fraud" ], "models": [ "unspecified real-time face-swap tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Infiltrations reported up sharply year on year.", "confidence": "STRONG", "confidence_reason": "CrowdStrike says operatives very likely use real-time deepfakes, based on investigator observation.", "summary": "CrowdStrike reports a surge in DPRK worker infiltrations, with GenAI for resumes and likely real-time deepfakes in interviews.", "quote": "Famous Chollima operatives very likely use real-time deepfake technology to mask their true identities in video interviews", "sources": [ { "title": "North Korean IT worker infiltrations exploded", "publisher": "Fortune", "url": "https://fortune.com/2025/08/04/north-korean-it-worker-infiltrations-exploded/", "date": "2025-08-04", "kind": "secondary", "verified": true } ] }, { "id": "dprk-it-workers-claude-2025", "title": "North Korean IT workers used Claude to get and keep Western tech jobs", "date": "2025-08", "disclosed": "2025-08-27", "actor": "North Korean IT worker operatives", "actor_type": "nation-state", "nexus": "North Korea", "targets": "US Fortune 500 technology companies", "ai_role": [ "fraud", "social-engineering" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Accounts banned; salary revenue for the regime per source.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic states it discovered and disrupted the use.", "summary": "Operatives used Claude to build false identities, pass coding assessments and do the technical work once hired, evading sanctions.", "quote": "North Korean operatives had been using Claude to fraudulently secure and maintain remote employment positions at US Fortune 500 technology companies.", "sources": [ { "title": "Detecting and countering misuse of AI: August 2025", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "date": "2025-08-27", "kind": "primary", "verified": true } ] }, { "id": "amazon-q-vscode-wiper-prompt", "title": "Malicious wiper prompt shipped in Amazon Q Developer VS Code extension", "date": "2025-07-17", "disclosed": "2025-07-23", "actor": "lkmanka58 (alias)", "actor_type": "unknown", "nexus": null, "targets": "Amazon Q Developer extension for VS Code (about 1M installs), release 1.84.0", "ai_role": [ "supply-chain", "agentic-intrusion" ], "models": [ "Amazon Q Developer agent (target of the prompt)" ], "model_basis": "stated-by-researcher", "autonomy": "autonomous", "outcome": "Prompt told the agent to wipe local files and delete AWS resources; AWS and others report it failed to execute. Fixed in 1.85.0.", "confidence": "STRONG", "confidence_reason": "AWS confirms attacker code was auto-released; the wiper prompt text and failed execution come from AWS and press, and this page does not quote the prompt itself.", "summary": "Via an over-scoped build token the attacker committed instructions aimed at the Amazon Q coding agent, directing it to reset a system to near-factory state and delete cloud resources. The attacker later said it was meant as a warning. AWS says no customer environment was affected.", "quote": "the threat actor was able to commit malicious code into the extension's open-source repository that was automatically included in a release.", "sources": [ { "title": "AWS-2025-015 security bulletin", "publisher": "Amazon Web Services", "url": "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/", "date": "2025-07-23", "kind": "primary", "verified": true } ] }, { "id": "kimsuky-chatgpt-fake-military-id", "title": "Kimsuky phishing uses ChatGPT-made fake South Korean military IDs", "date": "2025-07-17", "disclosed": "2025-09-15", "actor": "Kimsuky (APT43)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "South Korean defense-related institutions, journalists, researchers, activists", "ai_role": [ "deepfake", "phishing-content", "social-engineering" ], "models": [ "ChatGPT" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Spear-phishing with forged ID image lures delivered malware via ZIP and AutoIt/batch scripts.", "confidence": "CONFIRMED", "confidence_reason": "Genians' metadata analysis of the PNG lures identified ChatGPT as the generator; the OpenAI/other-vendor angle is covered elsewhere.", "summary": "The attackers sent emails posing as a defense ID agency with deepfake military ID images. Genians' analysis found the images were produced with ChatGPT. Opening the attachment ran scripts that enabled data theft and remote access.", "quote": "Emergence of APT attacks using generative AI \"ChatGPT\"", "sources": [ { "title": "AI-Driven Deepfake-Based Military ID Forgery APT Campaign", "publisher": "Genians Security Center", "url": "https://www.genians.co.kr/en/blog/threat_intelligence/deepfake", "date": "2025-09-15", "kind": "primary", "verified": true }, { "title": "North Korean operation uses ChatGPT to forge military IDs", "publisher": "The Record", "url": "https://therecord.media/north-korea-kimsuky-hackers-phishing-fake-military-ids-chatgpt", "date": "2025-09-15", "kind": "secondary", "verified": true } ] }, { "id": "claude-code-data-extortion-2025", "title": "Vibe-hacking data extortion of 17 organizations with Claude Code", "date": "2025-07", "disclosed": "2025-08-27", "actor": "Unnamed cybercriminal (tracked by Anthropic in its full report as GTG-2002)", "actor_type": "criminal", "nexus": null, "targets": "At least 17 organizations: healthcare, emergency services, government, religious institutions", "ai_role": [ "recon", "agentic-intrusion", "data-analysis", "ops-automation", "fraud" ], "models": [ "Claude Code" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Data stolen and extortion demands sometimes above $500,000; account banned.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic disrupted the actor and describes the activity from its own telemetry.", "summary": "Claude Code automated recon, credential harvesting and network penetration, chose which data to exfiltrate, analyzed financial data to set ransom amounts, and drafted the ransom notes.", "quote": "The actor used AI to what we believe is an unprecedented degree. Claude Code was used to automate reconnaissance, harvesting victims' credentials, and penetrating networks.", "sources": [ { "title": "Detecting and countering misuse of AI: August 2025", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "date": "2025-08-27", "kind": "primary", "verified": true } ] }, { "id": "koske-ai-assisted-linux-cryptominer", "title": "Koske Linux cryptominer shows signs of AI-assisted development", "date": "2025-07", "disclosed": "2025-07-24", "actor": "Unnamed (Koske)", "actor_type": "criminal", "nexus": null, "targets": "Misconfigured JupyterLab instances", "ai_role": [ "malware-dev", "evasion" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "Fileless cryptominer with rootkit, delivered through polyglot panda JPEGs.", "confidence": "STRONG", "confidence_reason": "Aqua infers LLM help from verbose, modular, well-commented code; wording is 'likely'.", "summary": "Aqua Nautilus analyzed a modular Linux miner delivered via image files. They judged its scripts were likely written with an LLM's help.", "quote": "Koske, a sophisticated Linux threat, shows clear signs of AI-assisted development, likely with help from a large language model.", "sources": [ { "title": "AI-Generated Malware in Panda Image Hides Persistent Linux Threat", "publisher": "Aqua Security", "url": "https://www.aquasec.com/blog/ai-generated-malware-in-panda-image-hides-persistent-linux-threat/", "date": "2025-07-24", "kind": "primary", "verified": true } ] }, { "id": "jasper-sleet-faceswap-voice-changing-2025", "title": "Microsoft: Jasper Sleet uses Faceswap and voice changers for fake IT workers", "date": "2025-06-30", "disclosed": "2025-06-30", "activity": "2024", "actor": "Jasper Sleet (and Coral Sleet)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Western employers hiring remote IT staff", "ai_role": [ "social-engineering", "deepfake", "fraud" ], "models": [ "Faceswap", "unspecified voice-changing software" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Microsoft suspended about 3,000 related accounts.", "confidence": "CONFIRMED", "confidence_reason": "Microsoft Threat Intelligence names Faceswap and voice-changing software.", "summary": "Since 2024 the workers used AI to swap faces into stolen identity documents and make headshots, and voice changers in interviews. A March 2026 Microsoft report describes AI use at every stage of hiring.", "quote": "use AI tools like Faceswap to move their pictures over to the stolen employment and identity documents", "sources": [ { "title": "Jasper Sleet: North Korean remote IT workers' evolving tactics", "publisher": "Microsoft", "url": "https://www.microsoft.com/en-us/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/", "date": "2025-06-30", "kind": "primary", "verified": true }, { "title": "AI as tradecraft: How threat actors operationalize AI", "publisher": "Microsoft", "url": "https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/", "date": "2026-03-06", "kind": "primary", "verified": true } ] }, { "id": "openai-dprk-deceptive-employment-2025", "title": "OpenAI bans accounts tied to North Korea-style IT worker employment scheme", "date": "2025-06-05", "disclosed": "2025-06-05", "activity": "2025", "actor": "Suspected DPRK-linked IT worker campaigns", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Remote IT and software jobs worldwide", "ai_role": [ "social-engineering", "fraud" ], "models": [ "ChatGPT" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Accounts banned.", "confidence": "STRONG", "confidence_reason": "OpenAI says behaviour was consistent with DPRK schemes but could not confirm location or nationality.", "summary": "Actors used ChatGPT to mass-produce resumes and researched ways to bypass interview controls with VPNs and live-feed injectors. Details come from OpenAI's June 2025 report via press.", "quote": "OpenAI says it banned accounts potentially linked to N. Korea over deceptive employment scheme", "sources": [ { "title": "OpenAI says it banned accounts potentially linked to N. Korea over deceptive employment scheme", "publisher": "Korea Herald", "url": "https://www.koreaherald.com/article/10426133", "date": "2025-06-06", "kind": "secondary", "verified": true }, { "title": "Disrupting malicious uses of AI: June 2025", "publisher": "OpenAI", "url": "https://cdn.openai.com/threat-intelligence-reports/5f73af09-a3a3-4a55-992e-069237681620/disrupting-malicious-uses-of-ai-june-2025.pdf", "date": "2025-06-05", "kind": "primary", "verified": false } ] }, { "id": "apt28-promptsteal-lamehug-2025", "title": "APT28 deployed PROMPTSTEAL, malware that queries an LLM for commands, against Ukraine", "date": "2025-06", "disclosed": "2025-11-05", "actor": "APT28 (FROZENLAKE)", "actor_type": "nation-state", "nexus": "Russia", "targets": "Ukraine", "ai_role": [ "malware-runtime-llm", "data-analysis", "ops-automation" ], "models": [ "Qwen2.5-Coder-32B-Instruct (via Hugging Face API)", "Qwen2.5-Coder-32B-Instruct" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Used in live operations; reported by CERT-UA as LAMEHUG.", "confidence": "CONFIRMED", "confidence_reason": "Google reports first observed malware querying an LLM in live operations.", "summary": "PROMPTSTEAL posed as an image generator and used an LLM to produce Windows commands that collected system data and documents for exfiltration.", "quote": "APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations.", "sources": [ { "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "date": "2025-11-05", "kind": "primary", "verified": true }, { "title": "CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign", "publisher": "The Hacker News (quoting CERT-UA#16039)", "url": "https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html", "date": "2025-07-18", "kind": "secondary", "verified": true } ] }, { "id": "bluenoroff-deepfake-zoom-crypto-2025", "title": "BlueNoroff uses deepfaked executives in Zoom call to infect crypto employee", "date": "2025-06", "disclosed": "2025-06", "actor": "BlueNoroff / TA444 / Sapphire Sleet (Huntress: STARDUST CHOLLIMA)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Cryptocurrency foundation employee (macOS)", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Eight malicious binaries installed including keylogger and wallet hijacker.", "confidence": "STRONG", "confidence_reason": "Huntress incident analysis reports deepfaked leadership on the call; deepfake evidence is the victim account.", "summary": "A Telegram and Calendly lure led to a fake Zoom with deepfakes of known leaders who told the victim to install an extension, which was a malicious AppleScript. Huntress investigated in June 2025.", "quote": "North Korean hackers deepfake execs in Zoom call to spread Mac malware", "sources": [ { "title": "North Korean hackers deepfake execs in Zoom call to spread Mac malware", "publisher": "BleepingComputer", "url": "https://www.bleepingcomputer.com/news/security/north-korean-hackers-deepfake-execs-in-zoom-call-to-spread-mac-malware/", "date": "2025-06-26", "kind": "secondary", "verified": true }, { "title": "Inside BlueNoroff Web3 intrusion analysis", "publisher": "Huntress", "url": "https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis", "date": "2025-06-26", "kind": "primary", "verified": false } ] }, { "id": "promptflux-gemini-malware-2025", "title": "PROMPTFLUX malware rewrote itself hourly through the Gemini API", "date": "2025-06", "disclosed": "2025-11-05", "actor": "Unattributed (financially motivated indicators)", "actor_type": "criminal", "nexus": null, "targets": "Broad, industry-agnostic lures", "ai_role": [ "malware-runtime-llm", "evasion" ], "models": [ "Gemini (gemini-1.5-flash-latest)" ], "model_basis": "stated-by-vendor", "autonomy": "semi-autonomous", "outcome": "Experimental dropper; Google disabled the assets; no victim compromise shown.", "confidence": "CONFIRMED", "confidence_reason": "Google analyzed samples and disabled the API assets.", "summary": "A VBScript dropper called Gemini to obfuscate and regenerate its own code to evade antivirus.", "quote": "ensuring the new variant remains viable", "sources": [ { "title": "GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools", "date": "2025-11-05", "kind": "primary", "verified": true } ] }, { "id": "rubio-signal-ai-voice-impersonation-2025", "title": "Impostor uses AI voice of Marco Rubio on Signal", "date": "2025-06", "disclosed": "2025-07-08", "actor": "unknown", "actor_type": "unknown", "nexus": null, "targets": "Three foreign ministers, a US governor, a member of Congress", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "At least five non-Department individuals contacted; State Dept said no direct cyber threat to its systems.", "confidence": "CONFIRMED", "confidence_reason": "State Department cable (quoted by CBS) says AI-generated text and voice messages were used.", "summary": "A Signal account named like Rubio left AI voice messages for officials. The cable linked it to a May 2025 FBI-investigated impersonation.", "quote": "likely aimed to manipulate targeted individuals using AI-generated text and voice messages, with the goal of gaining access to information or accounts", "sources": [ { "title": "\"Unknown actor\" using AI to impersonate Rubio, State Department cable shows", "publisher": "CBS News", "url": "https://www.cbsnews.com/news/marco-rubio-ai-impersonator-state-department-cable", "date": "2025-07-08", "kind": "secondary", "verified": true }, { "title": "Impostor uses AI to impersonate Rubio", "publisher": "NPR", "url": "https://www.npr.org/2025/07/09/nx-s1-5462195/impostor-ai-impersonate-rubio-foreign-officials", "date": "2025-07-09", "kind": "secondary", "verified": true } ] }, { "id": "wiles-impersonation-ai-voice-2025", "title": "Impersonator of Trump chief of staff Susie Wiles calls officials", "date": "2025-05", "disclosed": "2025-05-30", "actor": "unknown", "actor_type": "unknown", "nexus": null, "targets": "Senators, governors and executives contacted as Susie Wiles", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "FBI investigating; outcome of contacts not public.", "confidence": "SUSPECTED", "confidence_reason": "WSJ-derived report says officials think AI may have imitated her voice; not confirmed.", "summary": "Calls and texts purporting to be Wiles reached prominent contacts from numbers that were not hers. Officials said AI voice imitation may have been used.", "quote": "US looking into attempt to impersonate Trump chief of staff Susie Wiles: Report", "sources": [ { "title": "US looking into attempt to impersonate Trump chief of staff Susie Wiles", "publisher": "Yahoo News", "url": "https://www.yahoo.com/news/us-looking-attempt-impersonate-trump-023644868.html", "date": "2025-05-30", "kind": "secondary", "verified": true } ] }, { "id": "fbi-ai-voice-senior-us-officials-2025", "title": "FBI warns of AI voice messages impersonating senior US officials", "date": "2025-04", "disclosed": "2025-05-15", "actor": "unknown", "actor_type": "unknown", "nexus": null, "targets": "Current and former senior US federal and state officials and their contacts", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Ongoing campaign since April 2025 aimed at taking over personal accounts.", "confidence": "CONFIRMED", "confidence_reason": "FBI IC3 PSA states AI-generated voice messages were used.", "summary": "Actors sent texts and AI-generated voice messages posing as senior officials to build rapport, then steer targets to other platforms to compromise accounts.", "quote": "The malicious actors have sent text messages and AI-generated voice messages", "sources": [ { "title": "Senior US Officials Impersonated in Malicious Messaging Campaign", "publisher": "FBI IC3", "url": "https://www.ic3.gov/PSA/2025/PSA250515", "date": "2025-05-15", "kind": "primary", "verified": true } ] }, { "id": "unit42-dprk-realtime-deepfake-interviews-2025", "title": "Unit 42: North Korean IT workers use real-time deepfakes in interviews", "date": "2025-04", "disclosed": "2025-04-21", "actor": "North Korean IT workers (Wagemole)", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Employers hiring remote staff", "ai_role": [ "deepfake", "social-engineering", "fraud" ], "models": [ "unspecified real-time face-swap tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Research finding; no single loss stated.", "confidence": "STRONG", "confidence_reason": "Unit 42 presents evidence and a demonstration, not a confirmed named case.", "summary": "Palo Alto Networks reports evidence that DPRK IT workers use real-time deepfakes to infiltrate organisations.", "quote": "Evidence suggests that North Korean IT workers are using real-time deepfake technology to infiltrate organizations through remote work positions", "sources": [ { "title": "North Korean synthetic identity creation", "publisher": "Palo Alto Networks Unit 42", "url": "https://unit42.paloaltonetworks.com/north-korean-synthetic-identity-creation/", "date": "2025-04-21", "kind": "primary", "verified": true }, { "title": "North Korean IT workers seen using AI tools to scam firms into hiring them", "publisher": "The Record", "url": "https://therecord.media/north-korean-it-workers-seen-using-ai-recruitment-scams", "date": "2025-04-10", "kind": "secondary", "verified": true } ] }, { "id": "singapore-deepfake-zoom-finance-director-2025", "title": "Singapore finance director sends US$499K after deepfake Zoom call", "date": "2025-03-25", "disclosed": "2025-04-07", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Unnamed multinational's Singapore finance director", "ai_role": [ "deepfake", "fraud", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "About US$499K transferred; recovered by Singapore and Hong Kong police when the scammers asked for another US$1.4M.", "confidence": "CONFIRMED", "confidence_reason": "Singapore Police Force statement, relayed by Mothership, says deepfakes impersonated executives.", "summary": "After a WhatsApp approach posing as the CFO, the finance director joined a Zoom with deepfaked executives and moved funds to a mule account. Police traced and froze the money.", "quote": "Finance director in S'pore transfers S$670,000 to scammers who used deepfake to impersonate company's executives", "sources": [ { "title": "Finance director in S'pore transfers S$670,000 to scammers who used deepfake", "publisher": "Mothership.sg", "url": "https://mothership.sg/2025/04/finance-director-scammed-deepfake/", "date": "2025-04-07", "kind": "secondary", "verified": true } ] }, { "id": "iot-camera-credential-scraping-2025", "title": "Actor used Claude to build scrapers for leaked IoT camera credentials", "date": "2025-03", "disclosed": "2025-04-23", "actor": "Unnamed sophisticated actor", "actor_type": "unknown", "nexus": null, "targets": "Internet-facing security cameras", "ai_role": [ "recon", "malware-dev", "ops-automation" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Account banned; Anthropic could not confirm successful deployment.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic investigated and banned the account but states deployment was unconfirmed.", "summary": "The actor used Claude to rewrite scraping tooling and process leaked usernames and passwords tied to security cameras, aiming to gain forced access to them.", "quote": "An actor leveraged Claude to enhance systems for identifying and processing exposed usernames and passwords associated with security cameras, while simultaneously collecting information on internet-facing targets to test these credentials against.", "sources": [ { "title": "Detecting and countering malicious uses of Claude: March 2025", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "date": "2025-04-23", "kind": "primary", "verified": true } ] }, { "id": "novice-malware-builder-2025", "title": "Novice actor built an evasive malware builder with Claude", "date": "2025-03", "disclosed": "2025-04-23", "actor": "Unnamed novice actor", "actor_type": "criminal", "nexus": null, "targets": "Unspecified", "ai_role": [ "malware-dev", "evasion" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Account banned; real-world deployment not confirmed.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic states it identified and banned the actor.", "summary": "A low-skill actor used Claude to grow a batch-script generator into a GUI builder for payloads aimed at evading security controls and keeping persistent access.", "quote": "We identified and banned a novice actor leveraging Claude to improve their technical capabilities and develop malicious tools beyond their actual skill level.", "sources": [ { "title": "Detecting and countering malicious uses of Claude: March 2025", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "date": "2025-04-23", "kind": "primary", "verified": true } ] }, { "id": "recruitment-fraud-language-sanitization-2025", "title": "Recruitment fraud campaign used Claude to polish scam messages", "date": "2025-03", "disclosed": "2025-04-23", "actor": "Unnamed actor", "actor_type": "criminal", "nexus": null, "targets": "Job seekers in Eastern Europe", "ai_role": [ "fraud", "social-engineering", "phishing-content" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Account banned; deployment success not confirmed.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic states it identified and banned the actor.", "summary": "The actor used Claude for real-time language sanitization to make recruitment scam messages read as fluent and credible.", "quote": "A recruitment fraud campaign leveraged Claude to enhance the content of scams targeting job seekers in Eastern European countries.", "sources": [ { "title": "Detecting and countering malicious uses of Claude: March 2025", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/detecting-and-countering-malicious-uses-of-claude-march-2025", "date": "2025-04-23", "kind": "primary", "verified": true } ] }, { "id": "crosetto-voice-clone-italian-tycoons-2025", "title": "Italian defence minister's cloned voice used to solicit tycoons", "date": "2025-02", "disclosed": "2025-02-10", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Italian business leaders (Moratti, Armani, Prada and others)", "ai_role": [ "deepfake", "fraud", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "Massimo Moratti reportedly sent nearly EUR 1M; Milan prosecutors froze it. Others did not pay.", "confidence": "STRONG", "confidence_reason": "Crosetto publicly reported the voice clone and Milan prosecutors opened a fraud case; victim list rests on press.", "summary": "Callers posing as Defence Minister Guido Crosetto asked wealthy Italians for money to free kidnapped journalists. Crosetto filed a complaint.", "quote": "Scammers clone Italian defence minister's voice with AI in ransom scheme", "sources": [ { "title": "Scammers clone Italian defence minister's voice with AI in ransom scheme", "publisher": "Euronews", "url": "https://www.euronews.com/2025/02/10/scammers-clone-italian-defence-ministers-voice-with-ai-in-ransom-scheme", "date": "2025-02-10", "kind": "secondary", "verified": true } ] }, { "id": "apt42-gemini-phishing-2025", "title": "APT42 used Gemini for phishing content and defense-expert recon", "date": "2025-01-29", "disclosed": "2025-01-29", "activity": "2024", "actor": "APT42", "actor_type": "nation-state", "nexus": "Iran", "targets": "Defense experts and a US defense organization", "ai_role": [ "recon", "phishing-content", "vuln-research" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports misuse; no breach attributed to the Gemini use in the report.", "confidence": "CONFIRMED", "confidence_reason": "Google observed the group's Gemini activity directly.", "summary": "Iranian APT42 used Gemini to research individual policy and defense experts, craft tailored phishing material, and research public vulnerabilities in products like Mikrotik, Apereo and Atlassian.", "quote": "APT42's Gemini activity reflected the group's focus on crafting successful phishing campaigns.", "sources": [ { "title": "Adversarial Misuse of Generative AI", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai", "date": "2025-01-29", "kind": "primary", "verified": true } ] }, { "id": "dprk-apts-gemini-2025", "title": "North Korean APTs used Gemini across attack phases and IT-worker fakery", "date": "2025-01-29", "disclosed": "2025-01-29", "activity": "2024", "actor": "Nine North Korea-backed groups", "actor_type": "nation-state", "nexus": "North Korea", "targets": "South Korea and US organizations; Western employers", "ai_role": [ "recon", "malware-dev", "evasion", "fraud" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports usage and account action.", "confidence": "CONFIRMED", "confidence_reason": "Google states it observed these groups using Gemini.", "summary": "North Korean actors used Gemini for infrastructure research, target recon, payload development and evasion scripting, and to draft cover letters and research jobs for the clandestine IT worker scheme.", "quote": "North Korean APT actors used Gemini to support several phases of the attack lifecycle, including researching potential infrastructure and free hosting providers, reconnaissance on target organizations, payload development, and assistance with malicious scripting and evasion techniques.", "sources": [ { "title": "Adversarial Misuse of Generative AI", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai", "date": "2025-01-29", "kind": "primary", "verified": true } ] }, { "id": "prc-apts-gemini-2025", "title": "PRC-backed APT groups used Gemini for recon, scripting and post-compromise research", "date": "2025-01-29", "disclosed": "2025-01-29", "activity": "2024", "actor": "Over 20 China-backed groups", "actor_type": "nation-state", "nexus": "China", "targets": "Unspecified targets", "ai_role": [ "recon", "malware-dev", "vuln-research", "evasion" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Google reports usage; no specific breach tied to Gemini use.", "confidence": "CONFIRMED", "confidence_reason": "Google states it observed these groups using Gemini.", "summary": "Chinese APT actors used Gemini for reconnaissance, scripting and troubleshooting, and for research on lateral movement, privilege escalation, data exfiltration and detection evasion.", "quote": "Chinese APT actors used Gemini to conduct reconnaissance, for scripting and development, to troubleshoot code, and to research how to obtain deeper access to target networks.", "sources": [ { "title": "Adversarial Misuse of Generative AI", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai", "date": "2025-01-29", "kind": "primary", "verified": true } ] }, { "id": "russian-apts-gemini-2025", "title": "Russian APT actors used Gemini to port and encrypt malware code", "date": "2025-01-29", "disclosed": "2025-01-29", "activity": "2024", "actor": "Russian government-backed APT actors", "actor_type": "nation-state", "nexus": "Russia", "targets": "Unspecified", "ai_role": [ "malware-dev" ], "models": [ "Gemini" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Limited use observed.", "confidence": "CONFIRMED", "confidence_reason": "Google states it observed this use; volume was limited.", "summary": "Russian APT actors used Gemini for coding tasks such as converting public malware into another language and adding encryption functions.", "quote": "Their Gemini use focused on coding tasks, including converting publicly available malware into another coding language and adding encryption functions to existing code", "sources": [ { "title": "Adversarial Misuse of Generative AI", "publisher": "Google Threat Intelligence Group", "url": "https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse-generative-ai", "date": "2025-01-29", "kind": "primary", "verified": true } ] }, { "id": "no-code-ransomware-as-a-service-2025", "title": "Low-skill actor sold Claude-built ransomware for $400-$1200", "date": "2025-01", "disclosed": "2025-08-27", "actor": "Unnamed cybercriminal (tracked by Anthropic in its full report as GTG-5004)", "actor_type": "criminal", "nexus": null, "targets": "Buyers on cybercrime forums", "ai_role": [ "malware-dev", "evasion" ], "models": [ "Claude" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "Account banned; ransomware sold on forums from January 2025.", "confidence": "CONFIRMED", "confidence_reason": "Anthropic states the actor could not build the malware without Claude.", "summary": "The actor used Claude to develop ransomware with encryption, evasion and anti-recovery features and sold variants on forums.", "quote": "This actor appears to have been dependent on AI to develop functional malware.", "sources": [ { "title": "Detecting and countering misuse of AI: August 2025", "publisher": "Anthropic", "url": "https://www.anthropic.com/news/detecting-countering-misuse-aug-2025", "date": "2025-08-27", "kind": "primary", "verified": true } ] }, { "id": "vidoc-deepfake-candidates-2025", "title": "Vidoc Security interviews two deepfake job candidates", "date": "2025-01", "disclosed": "2025-02-11", "actor": "unknown (possible DPRK link)", "actor_type": "unknown", "nexus": null, "targets": "Vidoc Security Lab (hiring)", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "Blocked; second candidate confronted and recorded, no hire made.", "confidence": "STRONG", "confidence_reason": "Victim cofounder documents glitchy AI face and refusal of a hand-in-front-of-face test; North Korea link is suspicion only.", "summary": "Two applicants hid behind deepfake avatars; the company nearly gave an offer to the first and caught the second live.", "quote": "two imposters hiding behind deepfake avatars almost succeeded in tricking your startup into hiring them", "sources": [ { "title": "AI fakers exposed in tech dev recruitment: postmortem", "publisher": "The Pragmatic Engineer", "url": "https://newsletter.pragmaticengineer.com/p/ai-fakers", "date": "2025-03-11", "kind": "secondary", "verified": true }, { "title": "I'm a security expert, and I almost fell for a North Korea-style deepfake job applicant", "publisher": "The Register", "url": "https://www.theregister.com/2025/02/11/it_worker_scam", "date": "2025-02-11", "kind": "secondary", "verified": true } ] }, { "id": "funksec-ai-assisted-ransomware", "title": "FunkSec ransomware group builds tools with AI assistance", "date": "2024-12", "disclosed": "2025-01-10", "actor": "FunkSec", "actor_type": "criminal", "nexus": "Algeria", "targets": "Global victims across sectors, 85+ leak-site victims in Dec 2024", "ai_role": [ "malware-dev" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "Rust ransomware, double extortion and DDoS tooling; some claimed leaks recycled from earlier hacktivism.", "confidence": "STRONG", "confidence_reason": "Check Point attributes AI-assisted development from code artifacts; no model named on the report page.", "summary": "Check Point reported a fast-rising ransomware group whose encryptor and tooling appear AI-assisted, letting a relatively inexperienced author iterate quickly. Code comments in unusually perfect English were cited as a tell.", "quote": "FunkSec operators appear to use AI-assisted malware development which can enable even inexperienced actors to quickly produce and refine advanced tools.", "sources": [ { "title": "FunkSec: alleged top ransomware group powered by AI", "publisher": "Check Point Research", "url": "https://research.checkpoint.com/2025/funksec-alleged-top-ransomware-group-powered-by-ai/", "date": "2025-01-10", "kind": "primary", "verified": true } ] }, { "id": "wiz-ceo-deepfake-voice-attempt-2024", "title": "Wiz employees get deepfake voice messages from CEO", "date": "2024-10", "disclosed": "2024-10-28", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Wiz (cloud security), dozens of employees", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "Blocked; employees noticed it did not sound like the CEO. Credentials were the goal.", "confidence": "CONFIRMED", "confidence_reason": "CEO Assaf Rappaport described the attack on stage at TechCrunch Disrupt.", "summary": "Attackers cloned the CEO's voice from a conference recording and sent voice messages to dozens of employees to harvest credentials. The conference voice differed from his everyday voice, which tipped staff off.", "quote": "Dozens of my employees got a voice message from me", "sources": [ { "title": "Wiz CEO says company was targeted with deepfake attack that used his voice", "publisher": "TechCrunch", "url": "https://techcrunch.com/2024/10/28/wiz-ceo-says-company-was-targeted-with-deepfake-attack-that-used-his-voice/", "date": "2024-10-28", "kind": "secondary", "verified": true } ] }, { "id": "cardin-kuleba-deepfake-zoom-2024", "title": "Senator Cardin targeted by deepfake of Ukraine's ex-foreign minister", "date": "2024-09-19", "disclosed": "2024-09-23", "actor": "unknown", "actor_type": "unknown", "nexus": null, "targets": "US Senate Foreign Relations Chair Ben Cardin", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "Call ended when the fake began pressing on long-range missiles; State Dept confirmed it was not Kuleba. FBI investigating.", "confidence": "STRONG", "confidence_reason": "Senate security notice called it an apparent deepfake; attribution and tooling unconfirmed.", "summary": "Cardin's office joined a Zoom with a live audio-video likeness of Dmytro Kuleba that began asking out-of-character political questions. Russia was suspected by briefed people.", "quote": "Sen. Ben Cardin says he was targeted by apparent deepfake call", "sources": [ { "title": "Sen. Ben Cardin says he was targeted by apparent deepfake call", "publisher": "NBC News", "url": "https://www.nbcnews.com/politics/congress/ben-cardin-targeted-apparent-deep-fake-call-dmytro-kuleba-rcna172776", "date": "2024-09-25", "kind": "secondary", "verified": true } ] }, { "id": "knowbe4-dprk-fake-it-worker-2024", "title": "KnowBe4 hires North Korean IT worker using AI-enhanced photo", "date": "2024-07-15", "disclosed": "2024-07-23", "actor": "North Korean IT worker scheme", "actor_type": "nation-state", "nexus": "North Korea", "targets": "KnowBe4 (security awareness)", "ai_role": [ "social-engineering", "deepfake" ], "models": [ "unspecified AI image-enhancement tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "Laptop started loading malware on arrival and was isolated in about 25 minutes; KnowBe4 says no data was accessed.", "confidence": "CONFIRMED", "confidence_reason": "KnowBe4's CEO post says the application photo was AI-enhanced from stock imagery (per search summary of the page; the exact sentence was not located in the fetched text).", "summary": "KnowBe4 hired a remote engineer using a stolen valid US identity and an AI-altered photo after four video interviews. Company, Mandiant and FBI attributed it to a North Korean operation.", "quote": "How a North Korean Fake IT Worker Tried to Infiltrate Us", "sources": [ { "title": "How a North Korean Fake IT Worker Tried to Infiltrate Us", "publisher": "KnowBe4", "url": "https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us", "date": "2024-07-23", "kind": "primary", "verified": true }, { "title": "Cyber firm KnowBe4 hired a fake IT worker from North Korea", "publisher": "CyberScoop", "url": "https://cyberscoop.com/cyber-firm-knowbe4-hired-a-fake-it-worker-from-north-korea/", "date": "2024-07-24", "kind": "secondary", "verified": true } ] }, { "id": "ferrari-ceo-voice-clone-attempt-2024", "title": "Ferrari executive foils CEO voice-clone call", "date": "2024-07", "disclosed": "2024-07-26", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Ferrari executive", "ai_role": [ "deepfake", "social-engineering", "fraud" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-researcher", "autonomy": "assist", "outcome": "Blocked; the caller hung up when asked about a book the real CEO had recommended.", "confidence": "STRONG", "confidence_reason": "Bloomberg reporting from people familiar; Ferrari declined to comment.", "summary": "An executive got WhatsApp messages and then a call imitating CEO Benedetto Vigna's accent about a confidential deal needing a currency hedge. A personal verification question ended the call.", "quote": "Sorry, Benedetto, but I need to identify you", "sources": [ { "title": "Ferrari Exec Nearly Duped By Deepfake Voice Of CEO Benedetto Vigna In Scam Attempt", "publisher": "Jalopnik", "url": "https://www.jalopnik.com/ferrari-exec-nearly-duped-by-deepfake-voice-of-ceo-bene-1851608088/", "date": "2024-07-27", "kind": "secondary", "verified": true } ] }, { "id": "asyncrat-genai-vbscript-france", "title": "AsyncRAT campaign with GenAI-written VBScript and JavaScript", "date": "2024-06", "disclosed": "2024-09-25", "actor": "Unnamed", "actor_type": "criminal", "nexus": null, "targets": "French-speaking users, invoice-themed phishing", "ai_role": [ "malware-dev" ], "models": [ "unspecified GenAI" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "Infection chain deployed AsyncRAT remote access trojan.", "confidence": "STRONG", "confidence_reason": "HP Wolf judged GenAI authorship highly likely from unobfuscated code, comments and naming; no model named.", "summary": "HP Wolf found a campaign spreading AsyncRAT through HTML smuggling and VBScript/JavaScript droppers. The scripts' structure, comments and variable names pointed to generative AI authorship.", "quote": "a malware campaign spreading AsyncRAT using VBScript (T1059.005) and JavaScript (T1059.007) that was highly likely to have been written with the help of GenAI.", "sources": [ { "title": "HP Wolf Security Threat Insights Report: September 2024", "publisher": "HP Wolf Security", "url": "https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-september-2024/", "date": "2024-09-25", "kind": "primary", "verified": true } ] }, { "id": "wpp-ceo-deepfake-meeting-attempt-2024", "title": "WPP CEO impersonated with voice clone in fake Teams meeting", "date": "2024-05", "disclosed": "2024-05-10", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "WPP (advertising)", "ai_role": [ "deepfake", "social-engineering", "fraud" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "Attempt failed; no money lost per reporting.", "confidence": "CONFIRMED", "confidence_reason": "WPP confirmed the attempt to the Guardian, which describes a voice clone and YouTube footage.", "summary": "Fraudsters set up a fake WhatsApp account with Mark Read's photo and a virtual meeting using a voice clone and YouTube footage to solicit money and details from an agency leader. Staff recognised the attempt.", "quote": "fraudsters impersonated WPP's CEO using a fake WhatsApp account, a voice clone and YouTube footage", "sources": [ { "title": "CEO of world's biggest ad firm targeted by deepfake scam", "publisher": "The Guardian", "url": "https://www.theguardian.com/technology/article/2024/may/10/ceo-wpp-deepfake-scam", "date": "2024-05-10", "kind": "secondary", "verified": true } ] }, { "id": "lastpass-deepfake-ceo-voice-attempt-2024", "title": "LastPass employee targeted with deepfake CEO voice call", "date": "2024-04", "disclosed": "2024-04-10", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "LastPass employee", "ai_role": [ "deepfake", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "Blocked; employee ignored WhatsApp calls and messages and reported them.", "confidence": "CONFIRMED", "confidence_reason": "LastPass published the incident and called it an audio deepfake.", "summary": "An employee received WhatsApp calls, texts and a voicemail using an audio deepfake of the CEO, with urgency pressure. The employee recognised the signs and reported it; no impact.", "quote": "Attempted Audio Deepfake Call Targets LastPass Employee", "sources": [ { "title": "Attempted Audio Deepfake Call Targets LastPass Employee", "publisher": "LastPass", "url": "https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee", "date": "2024-04-10", "kind": "primary", "verified": false } ] }, { "id": "ta547-rhadamanthys-llm-powershell", "title": "TA547 delivers Rhadamanthys stealer with likely LLM-written PowerShell", "date": "2024-04", "disclosed": "2024-04-10", "actor": "TA547", "actor_type": "criminal", "nexus": null, "targets": "German organizations, invoice lure impersonating retailer Metro", "ai_role": [ "malware-dev" ], "models": [ "unspecified LLM" ], "model_basis": "inferred", "autonomy": "assist", "outcome": "Campaign delivered Rhadamanthys information stealer via a PowerShell loader.", "confidence": "STRONG", "confidence_reason": "Proofpoint researchers inferred LLM authorship from the script's style; no model is named.", "summary": "Proofpoint observed TA547 using a PowerShell script that its researchers suspect was generated by an LLM. The script ran in a chain that ended with the Rhadamanthys stealer. This is one of the earliest vendor-reported cases of an LLM-written loader from a tracked criminal actor.", "quote": "the actor appeared to use a PowerShell script that researchers suspect was generated by large language model (LLM) such as ChatGPT, Gemini, CoPilot, etc.", "sources": [ { "title": "Security Brief: TA547 Targets German Organizations with Rhadamanthys Stealer", "publisher": "Proofpoint", "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta547-targets-german-organizations-rhadamanthys-stealer", "date": "2024-04-10", "kind": "primary", "verified": true } ] }, { "id": "charcoal-typhoon-chatgpt-2024", "title": "Charcoal Typhoon used ChatGPT for research, scripting and phishing content", "date": "2024-02", "disclosed": "2024-02-14", "actor": "Charcoal Typhoon", "actor_type": "nation-state", "nexus": "China", "targets": "Government and defense-related targets (per source)", "ai_role": [ "recon", "malware-dev", "phishing-content" ], "models": [ "ChatGPT (OpenAI services)" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "OpenAI accounts disabled in coordination with Microsoft.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.", "summary": "The China-affiliated group used ChatGPT to research companies and security tools, debug code and generate scripts, and write likely phishing content.", "quote": "Charcoal Typhoon used our services to research various companies and cybersecurity tools, debug code and generate scripts, and create content likely for use in phishing campaigns.", "sources": [ { "title": "Disrupting malicious uses of AI by state-affiliated threat actors", "publisher": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "date": "2024-02-14", "kind": "primary", "verified": true }, { "title": "Staying ahead of threat actors in the age of AI", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "date": "2024-02-14", "kind": "primary", "verified": true } ] }, { "id": "crimson-sandstorm-chatgpt-2024", "title": "Crimson Sandstorm used ChatGPT for research, scripting and phishing content", "date": "2024-02", "disclosed": "2024-02-14", "actor": "Crimson Sandstorm", "actor_type": "nation-state", "nexus": "Iran", "targets": "Government and defense-related targets (per source)", "ai_role": [ "malware-dev", "phishing-content", "evasion" ], "models": [ "ChatGPT (OpenAI services)" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "OpenAI accounts disabled in coordination with Microsoft.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.", "summary": "The Iran-affiliated group used ChatGPT for app and web scripting, likely spear-phishing content, and research on malware evasion.", "quote": "Crimson Sandstorm used our services for scripting support related to app and web development, generating content likely for spear-phishing campaigns, and researching common ways malware could evade detection.", "sources": [ { "title": "Disrupting malicious uses of AI by state-affiliated threat actors", "publisher": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "date": "2024-02-14", "kind": "primary", "verified": true }, { "title": "Staying ahead of threat actors in the age of AI", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "date": "2024-02-14", "kind": "primary", "verified": true } ] }, { "id": "emerald-sleet-chatgpt-2024", "title": "Emerald Sleet used ChatGPT for research, scripting and phishing content", "date": "2024-02", "disclosed": "2024-02-14", "actor": "Emerald Sleet", "actor_type": "nation-state", "nexus": "North Korea", "targets": "Government and defense-related targets (per source)", "ai_role": [ "recon", "vuln-research", "phishing-content" ], "models": [ "ChatGPT (OpenAI services)" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "OpenAI accounts disabled in coordination with Microsoft.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.", "summary": "The North Korea-affiliated group used ChatGPT to find defense experts in the Asia-Pacific, understand public vulnerabilities, script, and draft phishing content.", "quote": "Emerald Sleet used our services to identify experts and organizations focused on defense issues in the Asia-Pacific region, understand publicly available vulnerabilities, help with basic scripting tasks, and draft content that could be used in phishing campaigns.", "sources": [ { "title": "Disrupting malicious uses of AI by state-affiliated threat actors", "publisher": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "date": "2024-02-14", "kind": "primary", "verified": true }, { "title": "Staying ahead of threat actors in the age of AI", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "date": "2024-02-14", "kind": "primary", "verified": true } ] }, { "id": "forest-blizzard-chatgpt-2024", "title": "Forest Blizzard used ChatGPT for research, scripting and phishing content", "date": "2024-02", "disclosed": "2024-02-14", "actor": "Forest Blizzard", "actor_type": "nation-state", "nexus": "Russia", "targets": "Government and defense-related targets (per source)", "ai_role": [ "recon", "malware-dev" ], "models": [ "ChatGPT (OpenAI services)" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "OpenAI accounts disabled in coordination with Microsoft.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.", "summary": "The Russia-affiliated group used ChatGPT mainly for open-source research on satellite communication and radar imaging, plus scripting help.", "quote": "Forest Blizzard used our services primarily for open-source research into satellite communication protocols and radar imaging technology, as well as for support with scripting tasks.", "sources": [ { "title": "Disrupting malicious uses of AI by state-affiliated threat actors", "publisher": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "date": "2024-02-14", "kind": "primary", "verified": true }, { "title": "Staying ahead of threat actors in the age of AI", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "date": "2024-02-14", "kind": "primary", "verified": true } ] }, { "id": "salmon-typhoon-chatgpt-2024", "title": "Salmon Typhoon used ChatGPT for research, scripting and phishing content", "date": "2024-02", "disclosed": "2024-02-14", "actor": "Salmon Typhoon", "actor_type": "nation-state", "nexus": "China", "targets": "Government and defense-related targets (per source)", "ai_role": [ "recon", "malware-dev", "evasion" ], "models": [ "ChatGPT (OpenAI services)" ], "model_basis": "stated-by-vendor", "autonomy": "assist", "outcome": "OpenAI accounts disabled in coordination with Microsoft.", "confidence": "CONFIRMED", "confidence_reason": "OpenAI and Microsoft both state the accounts were tied to this actor; activity was limited, non-novel assistance.", "summary": "The China-affiliated group used ChatGPT to translate technical papers, gather public information on intelligence agencies, help with code, and research ways to hide processes on a system.", "quote": "Salmon Typhoon used our services to translate technical papers, retrieve publicly available information on multiple intelligence agencies and regional threat actors, assist with coding, and research common ways processes could be hidden on a system.", "sources": [ { "title": "Disrupting malicious uses of AI by state-affiliated threat actors", "publisher": "OpenAI", "url": "https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/", "date": "2024-02-14", "kind": "primary", "verified": true }, { "title": "Staying ahead of threat actors in the age of AI", "publisher": "Microsoft Security Blog", "url": "https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/", "date": "2024-02-14", "kind": "primary", "verified": true } ] }, { "id": "arup-hong-kong-deepfake-video-call-2024", "title": "Arup employee tricked by deepfake video call into $25M transfers", "date": "2024-01", "disclosed": "2024-05-16", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Arup (engineering), Hong Kong office", "ai_role": [ "deepfake", "fraud", "social-engineering" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "unknown", "autonomy": "assist", "outcome": "About US$25M (HK$200M) sent in 15 transfers to fraudsters' accounts.", "confidence": "CONFIRMED", "confidence_reason": "Arup confirmed it was the victim of the deepfake scam reported by Hong Kong police.", "summary": "A finance employee joined a video call in which the apparent CFO and colleagues were deepfakes and followed instructions to make multiple transfers. Hong Kong police disclosed the case in Feb 2024; CNN named Arup as the victim in May 2024.", "quote": "Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee", "sources": [ { "title": "Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee", "publisher": "CNN Business", "url": "https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk/index.html", "date": "2024-05-16", "kind": "secondary", "verified": true } ] }, { "id": "retool-deepfake-voice-vishing-2023", "title": "Retool breached via SMS phishing and deepfaked employee voice", "date": "2023-08-27", "disclosed": "2023-09-13", "actor": "unknown", "actor_type": "criminal", "nexus": null, "targets": "Retool (software), crypto customers", "ai_role": [ "social-engineering", "deepfake" ], "models": [ "unspecified voice-clone/deepfake tool" ], "model_basis": "stated-by-victim", "autonomy": "assist", "outcome": "Attacker obtained an MFA code by phone and took over an employee's account; 27 cloud customers were affected and crypto customers lost funds.", "confidence": "CONFIRMED", "confidence_reason": "Retool's own post-mortem says the caller deepfaked the employee's voice.", "summary": "An employee clicked an SMS phishing link to a fake portal. The attacker then phoned the employee, using a deepfaked voice of a real colleague, and obtained the MFA code needed to take over the account.", "quote": "the attacker called the employee. The caller claimed to be one of the members of the IT team, and deepfaked our employee's actual voice.", "sources": [ { "title": "Retool: MFA isn't MFA", "publisher": "Retool", "url": "https://retool.com/blog/mfa-isnt-mfa", "date": "2023-09-13", "kind": "primary", "verified": true } ] } ] }