"At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited," John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG), told The Hacker News.
AI acceleration of criminal tradecraft, per GTIG
Google Threat Intelligence Group (GTIG) reported that financially motivated and espionage-focused adversaries are increasingly integrating artificial intelligence into offensive operations. GTIG said attackers have targeted proprietary AI models across healthcare, government, and media sectors, exfiltrated API credentials, and co-opted victim cloud environments to sustain unauthorized AI workloads — a shift that supports espionage, extortion, and resource theft.
TeamPCP’s supply-chain campaign and credential theft
GTIG identified a financially motivated actor known as TeamPCP (aka Altered Spider and UNC6780) as a principal driver of recent large-scale software supply chain compromises. The group has targeted package registries including PyPI, npm, and Docker Hub. GTIG described an operational pattern in which initial supply-chain compromises are followed by deployment of credential stealers — notably SANDCLOCK and its successor DUSTMAKER — to harvest sensitive data and monetize access through sales or partnerships with ransomware and data extortion groups.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDUSTMAKER and SANDCLOCK: technical distinctions and AI-targeting
GTIG provided technical distinctions between the two credential stealers. SANDCLOCK, used in March and April 2026 and publicly referred to as part of CanisterWorm, was primarily written in Python, designed to operate on Linux, interact with Kubernetes, and included container escape functionality; it targeted cryptocurrency wallets in addition to cloud and developer credentials. DUSTMAKER, used from April onward, is a cross-platform JavaScript payload optimized for CI/CD pipelines. GTIG said DUSTMAKER lacks container escape functionality and — while some variants targeted wallets — focuses on credential theft to facilitate extortion. Crucially, GTIG said the AI-targeting techniques in DUSTMAKER, specifically poisoning AI assistant workspaces and using prompt injection for defense evasion, were exclusive to DUSTMAKER and were not present in earlier SANDCLOCK variants.
UNC6508, local LLM hosting, and distillation attacks
GTIG described separate activity by a China-nexus actor known as UNC6508 that compromised cloud environments to deploy local LLM infrastructure using open-weight models rather than commercial frontier models, a tactic intended to evade monitoring by AI model providers. The report also noted multiple data theft extortion operations in which threat actors have stolen proprietary AI assets — models, skills, prompts, source code, and related research — and observed distillation attacks aimed at degrading Google's visual and audio understanding, image generation, and video generation capabilities.
Autonomous, multi-agent credential harvesting in under six hours
In one case GTIG described, a financially motivated threat actor compromised an unnamed organization's cloud infrastructure and deployed an autonomous, multi-agent attack framework to conduct mass credential harvesting at scale. GTIG said the actor "leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours." Using preconfigured markdown instruction sets as operational playbooks, the system performed automated scanning and credential harvesting, compromising thousands of third-party credentials. The integration of AI enabled autonomous management of the vulnerability-scanning pipeline, real-time troubleshooting, and IP rotation logic without continuous human intervention.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: GTIG’s findings highlight an increased attack surface that includes developer tools and CI/CD pipelines, plus new AI-specific vectors such as workspace poisoning and prompt injection. The report calls attention to credential theft via expanded information-stealer toolsets and the hosting of local, open-weight models on compromised hosts.
- Policymakers and regulators: GTIG recommended industry-wide safety baselines for open-source AI and coordinated platform policies to restrict uncensored checkpoints. Google formalized a Frontier Safety Framework and Critical Capability Levels (CCLs) to evaluate when model capabilities make open deployment a security risk.
- Affected enterprises and procurement leaders: Enterprises that deploy AI or rely on third-party packages should note GTIG’s examples — supply-chain compromises on PyPI, npm, and Docker Hub, and the monetization of stolen credentials via extortion channels — when evaluating vendor risk, CI/CD security, and controls around API credential exposure.
GTIG’s account sketches an adversary landscape where AI speeds planning and execution, open models enable local, unmonitored misuse, and credential theft provides the fuel for varied criminal business models. The practical tradeoff GTIG describes is stark: open-weight models can drive innovation, but they also remove centralized visibility and guardrails that limit misuse. GTIG’s recommended response combines enforceable safety baselines for open-source AI, coordinated platform policies, and enterprise-platform containment as measures to raise the barrier for adversaries.
