Hackers built and launched an AI-assisted credential-stealing operation in less than six hours, compromising thousands of third-party credentials, according to new research from Google Threat Intelligence Group.
The finding marks a significant change in how cybercriminals are using artificial intelligence. AI is no longer being used only to write convincing phishing messages or research potential victims. Some attackers are now giving AI systems instructions to carry out multiple stages of an attack with far less human supervision.
Google’s latest GTIG AI Threat Tracker, released on September 8, says state-backed hacking groups and financially motivated criminals are moving from simple AI prompting towards what researchers call “agentic” workflows.
The shift could leave companies with much less time to detect and stop an intrusion. Tasks that once required an attacker to repeatedly intervene can increasingly be handled automatically.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
One attack went from stolen cloud access to mass credential theft in hours
In one case observed during the second quarter of 2026, attackers first compromised an organisation’s cloud infrastructure.
They then used an AI coding chatbot, instructions and operational playbooks to create a multi-agent system. Within six hours, it was scanning systems and harvesting credentials from third parties.
Google said the framework could troubleshoot problems on its own, rotate IP addresses and continue vulnerability scanning with limited manual intervention.
The attackers also operated through compromised cloud infrastructure. That meant malicious activity could appear to come from legitimate internet addresses rather than obviously suspicious criminal servers.
Another system uncovered by GTIG contained a dashboard capable of organising and validating more than 23,800 harvested secrets, including API keys connected to cloud and AI services.
These systems are not evidence that cyberattacks have become completely autonomous. Human attackers still choose targets, provide instructions and control broader operations.
But the amount of work that can now happen between those human decisions is expanding.
What are AI agents and why are they different from ChatGPT-style prompts?
A normal AI interaction usually begins when a person asks a chatbot to perform one task. The AI responds, and the person decides what to do next.
An AI agent can be given a broader goal and allowed to take several connected steps towards it. It may scan a system, analyse what it finds, correct an error and move to the next target without waiting for a fresh human instruction each time.
That difference matters in cybersecurity.
A criminal could previously use AI to help write malicious code. An agentic system could potentially help run parts of the operation itself, reducing the time between discovering a weakness and exploiting it.
Google says a China-linked espionage group it tracks as BASIN CASTLE has already integrated generative AI across several stages of cyber operations.
GTIG observed the group using large language models to research high-value targets, translate and draft social-engineering material, help create obfuscated malware and troubleshoot commands after gaining access to systems.
Attackers are also turning AI tools themselves into targets
The threat is moving in both directions. Criminals are using AI, but they are also attacking the growing infrastructure around AI.
GTIG said attackers have targeted proprietary models, source code, prompts, developer credentials and cloud computing resources across sectors including government, healthcare and media.
A financially motivated group tracked as UNC6780, or TeamPCP, has targeted open-source platforms including PyPI, npm and Docker Hub since March 2026.
Google says the group compromised developer accounts, inserted malicious code into software projects and designed malware to interact with AI coding assistants. In some cases, malicious instructions were hidden inside project files so that an AI coding tool could unknowingly execute attacker-controlled commands.
This raises a newer supply-chain risk. A developer may trust an AI assistant to inspect or install a software component without realising that the component itself has been designed to manipulate the AI tool.
Google had already warned in May that it had identified a threat actor using a zero-day exploit that the company believed had been developed with AI assistance. That was an early sign that AI use was progressing beyond simple productivity gains.
LLMJacking turns someone else’s cloud account into an AI bill
Another growing problem identified by Google is known as LLMJacking.
This happens when attackers steal credentials or compromise an organisation’s cloud environment so they can use expensive AI computing resources without paying for them.
GTIG found growing demand in criminal forums for stolen Gemini and Claude credentials as well as accounts linked to autonomous coding tools. It also observed malware specifically targeting configuration files that may contain AI API keys.
For businesses, this creates risks beyond an unexpected cloud bill. Stolen AI credentials can expose proprietary models, internal source code, prompts or sensitive corporate data.
For defenders, the larger problem is speed. AI allows attackers to research targets, write convincing messages, modify malicious code and troubleshoot failures much faster than before.
The gap between an attacker finding an opportunity and exploiting it is getting smaller.
What this means for you: Treat AI and cloud account credentials like banking passwords: never reuse them and enable multi-factor authentication wherever possible. Companies should also monitor unusual cloud or AI usage because a sudden spike may signal stolen credentials or an attacker using their infrastructure.
The420 Insight: The biggest change is not that AI has replaced hackers. It is that one hacker may increasingly control automated systems capable of doing work that once required an entire team, dramatically increasing the speed and scale of cyberattacks.
https://www.linkedin.com/company/policetechnology/
