“At this point, we can assume that all threat actors are using AI in some capacity and their operations have benefited,” John Hultquist, chief analyst at GTIG, warned.
UNC6780 and Dustmaker: supply-chain intrusions focused on AI environments
A Google Threat Intelligence Group (GTIG) report dated September 8 describes a financially motivated actor tracked as UNC6780 that has carried out large-scale open-source software supply chain compromises across PyPI, npm and Docker Hub. The group primarily targets AI environments and software dependencies for initial access using a family of malware GTIG calls Dustmaker.
Dustmaker employs multiple techniques tailored to modern AI development pipelines. The malware can extract tokens from the process memory of GitHub Actions runners, enabling UNC6780 to publish compromised package versions that “pass valid AI coding automated trust checks.” In other cases, Dustmaker drops or modifies malicious files into hidden project workspace directories for AI coding assistants, letting the malware blend into developer “noise” and evade detection. After initial access, the actor collects credentials to AI tools and then sells those credentials to other criminal groups.
GTIG noted the public release and apparent success of UNC6780 malware as a likely catalyst for imitation: “The publicity, apparent success, and open-source release of UNC6780 malware will likely spur adversary emulation of these tactics,” the report said.
How AI assistants and MCP servers have reshaped developer risk
GTIG ties the rise in supply-chain compromise to rapid changes in software development workflows. The report says accelerated adoption of large language models (LLMs) in production has increased the volume of open-source resources designed to support AI use cases — for example, model context protocol (MCP) servers — and that AI assistants have sped up development in ways that likely reduced scrutiny of third‑party packages and dependencies.
Those shifts create new, concentrated high-value targets inside the normal flow of developer work: tokens and artifacts in CI runners, hidden workspaces used by coding assistants, and automated checks that were designed to speed code publication rather than anticipate agentic or emplaced malware.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleUNC6508 and the theft of proprietary AI research in Q2 2026
GTIG observed a separate pattern in Q2 2026 of actors targeting proprietary AI data and models. A Chinese nation-state actor tracked as UNC6508 specifically targeted proprietary AI research in academic, medical and military research institutions in North America. More broadly, GTIG recorded multiple data-theft extortion operations in Q2 in which attackers stole proprietary AI data — including models, skills, prompts, source code and related research — and threatened public release unless a ransom demand was met.
These extortion incidents affected organizations operating in technology, healthcare, pharmaceutical and media and entertainment sectors in North America and Europe, indicating the geographic and sector spread of this second wave of AI-focused theft.
Agentic experimentation: Gemini, autonomous attack frameworks and Recon
GTIG documented threat actors moving beyond AI-assisted tooling toward agentic architectures and autonomous frameworks. In one case, a “Chinese-nexus actor” tried to leverage Gemini to build an automated pentesting framework capable of observing target state, reasoning about actions and executing in unpredictable environments. In another, a financially motivated actor used an AI-coding chatbot plus agent instructions to put together an autonomous, multi-agent attack framework that planned, built and executed a mass credential harvesting campaign in less than six hours after compromising cloud infrastructure.
GTIG also identified a command-and-control server hosting an automated reconnaissance and credential management framework called "Recon." Shortly after GTIG identified the server, an exposed directory became a live production frontend dashboard intended to organize, validate and manage over 23,800 harvested secrets in real time — including API keys for cloud and AI services.
What this means for technologists, enterprises, and policymakers
- Technologists and security teams: Expect exploitation focused on CI/CD artifacts and AI assistant workspaces; the report highlights token extraction from GitHub Actions runners and hidden workspace manipulation as immediate attack vectors.
- Enterprises and procurement leaders: Proprietary models, prompts and related research are now a frequent target of theft and extortion across North America and Europe — organizations using AI in healthcare, defense and research will face targeted risk, GTIG found.
- Policymakers and regulators: The GTIG findings show a convergence of espionage, financially motivated crime and agentic automation in the AI supply chain that could influence decisions on cyber incident reporting, software supply-chain standards and protection of sensitive research.
GTIG’s analysis links two trends: attackers weaponizing the new artifacts and workflows created by widespread LLM use, and threat actors themselves accelerating operations using AI. John Hultquist underscored the operational consequence: “Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to.” Whether defenders can close that time gap will shape the next phase of AI-era cyber conflict.
Source: AI Coding Tools Now a Prime Target for Threat Actors, Google Warns — Infosecurity Magazine
