Skip to navigation

Threat reportThreat IntelligenceTL-2026-2390

Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)

highACTIVE

Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents adversarial AI maturing from prompting toward autonomy: a financially motivated actor deployed an autonomous multi-agent framework that harvested thousands of third-party credentials in under six hours, and PRC-nexus actors used Gemini and CC Switch (Claude/Gemini/Codex) for exploit development and automated penetration testing.

Key facts

IdentifiersTL-2026-2390
Also known asGTIG AI Threat Tracker Q3 2026, From Prompting to Autonomy: The Evolution of Adversarial AI
SeverityHIGH
MalwareDUSTMAKER, HONESTCUE, PROMPTSPY, SANDCLOCK, SOMBERMEME, Shai-Hulud
ToolsCC Switch, OpenClaw, Phalanx, Recon, Shai-Hulud
MITRE ATT&CK / ATLAS techniquesAML.T0006 Active Scanning, AML.T0008 Acquire Infrastructure, AML.T0010 AI Supply Chain Compromise, AML.T0012 Valid Accounts, AML.T0040 AI Model Inference API Access, AML.T0051 LLM Prompt Injection, AML.T0054 LLM Jailbreak, T1027 Obfuscated Files or Information, T1059.006 Python, T1078 Valid Accounts, T1552 Unsecured Credentials, T1566 Phishing and 4 more in the attack flow
MotivationESPIONAGE
Target sectorstechnology, government administration, finance, defense, health, telecoms, academia
Target regionsGlobal, North America, Asia, Europe
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2390 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Autonomous Agentic Vulnerability Scanning Pipeline Reaching AI Model APIs — Exploitation Phase

Detects an internal host performing a large-scale active-scanning burst (100+ distinct ports and 20+ distinct destinations within one hour) while also making outbound calls to generative AI model inference endpoints (Gemini, Claude, OpenAI, DeepSeek). GTIG's Q3 2026 AI Threat Tracker documents financially motivated and PRC-nexus actors running autonomous multi-agent frameworks (Recon, Phalanx, CC Switch) that plan scanning pipelines, choose exploit targets, and resolve errors in real time via commercial LLM APIs. Co-occurrence of a scanning burst with AI-API calls on the same source IP is a strong automation signature for agentic exploitation of compromised cloud infrastructure, and pre-dates the credential-harvesting phase by the under-6-hour campaigns described in the report.

Splunk SPL

index=netflow sourcetype="netflow" earliest=-60m latest=now
| stats dc(dest_ip) as distinct_dest_ips, dc(dest_port) as distinct_ports, count as flows by src_ip
| where distinct_ports > 100 AND distinct_dest_ips > 20
| join type=inner src_ip [ search index=proxy sourcetype="pan:traffic" earliest=-60m (url="*generativelanguage.googleapis.com*" OR url="*api.anthropic.com*" OR url="*api.openai.com*" OR url="*api.deepseek.com*") | stats count as llm_api_hits by src_ip ]
| where llm_api_hits > 0
| eval ai_automation_score = (distinct_ports / 100) + (llm_api_hits / 10)
| table _time src_ip distinct_dest_ips distinct_ports flows llm_api_hits ai_automation_score
| sort - ai_automation_score

Microsoft KQL

let llm_api_hosts = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any ("generativelanguage.googleapis.com", "api.anthropic.com", "api.openai.com", "api.deepseek.com")
| summarize Devices = make_set(DeviceName) by DeviceId;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceId in (llm_api_hosts)
| summarize ScanDestinations = dcount(RemoteIP), ScanPorts = dcount(RemotePort) by DeviceId, DeviceName
| where ScanPorts > 100 and ScanDestinations > 20
| project DeviceName, ScanDestinations, ScanPorts
| sort by ScanPorts desc

Sigma

title: Agentic Scanner Invoking Generative AI Model APIs from a Scripting Host
id: a4f7c2e9-8b1d-4e5a-9c3f-2d7b1e6a9c04
status: experimental
description: Detects scanner binaries executed alongside requests to generative AI inference APIs, the process-level signature of autonomous agentic scanning pipelines (Recon, Phalanx) documented in GTIG's Q3 2026 AI Threat Tracker. Agent loops invoke nmap/masscan/nuclei while querying Gemini/Claude/OpenAI/DeepSeek to plan the next scan and debug errors in real time.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
author: Threadlinqs Team
date: 2026/09/08
tags:
  - attack.reconnaissance
  - attack.resource-development
  - attack.t1595
  - attack.t1595.001
  - attack.t1588
  - attack.t1059.006
  - attack.aml.t0006
  - attack.aml.t0040
  - attack.tool.recon
  - attack.tool.phalanx
logsource:
  category: process_creation
  product: linux
detection:
  selection_scanner:
    Image|endswith:
      - /nmap
      - /masscan
      - /nuclei
      - /sqlmap
      - /rustscan
      - /zmap
  selection_llm:
    CommandLine|contains:
      - generativelanguage.googleapis.com
      - api.anthropic.com
      - api.openai.com
      - api.deepseek.com
  condition: selection_scanner and selection_llm
falsepositives:
  - Authorized red-team engagements that pair scanners with LLM copilots
  - DevSecOps hosts running vulnerability scanners with LLM-assisted triage
level: medium

Known false positives:

  • Legitimate security teams running authorized external/internal scans from hosts that also use web-based LLM assistants
  • Cloud probe/health-check infrastructure that legitimately connects to many destinations

Tuning notes: Tune the distinct_ports / distinct_dest_ips thresholds to baseline scan volume per subnet (raise to >250 ports in high-noise DMZs). Whitelist licensed scanner hosts (Qualys, Tenable, Rapid7) and cloud provider health probes by src_ip. Consider adding an additional correlation step for outbound AI-API traffic on hosts NOT previously observed talking to any LLM endpoint (first-seen anomaly). Community OSINT for this threat also observed Google-themed phishing hosted on compromised subdomains (e.g., mybluehost.me, posmasters.lk); add those domains to the proxy deny/alert list and extend the LLM-API domain list as new model providers appear.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • AI-Orchestrated Exploit Development — Scanner Host Contacting Model Inference APIs · unlock with TL Creds
  • LLMJacking — Rogue Service Principal Provisioning Elevated AI Workloads · unlock with TL Creds
  • Beaconing to Web-Service C2 and Known C2 Infrastructure · unlock with TL Creds
  • Agentic Recon Framework Accessing Generative AI Model Inference APIs · unlock with TL Creds
  • Credential Stealer Accessing AI and Cloud Credential Stores · unlock with TL Creds
  • Server-Side Web-Service C2 and Exfiltration Channels (Discord CDN, BaaS, AI APIs) · unlock with TL Creds
  • AI Coding Assistant Configuration Hijacking — Hidden-Directory Persistence · unlock with TL Creds
  • Web-Service C2 and Credential Exfiltration via Generative AI APIs and Content CDNs · unlock with TL Creds

Indicators of compromise

As of 2026-09-08, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-2390.

Sample indicators (3 of 18)

  • IP address: 54.67.2[.]84
  • Domain: generativelanguage[.]googleapis[.]com
  • File hash: eb0687daed29f3651c61b0a2aa4a0cdcf2049a1ebae2e15e2dd9326471d318a1

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

18 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

An exposed C2 server ran the 'Recon' framework, a production dashboard managing over 23,800 harvested secrets, signaling a shift from passive infostealers to offensive agentic harvesting.

On September 8, 2026, Google Threat Intelligence Group (GTIG) published its Q3 2026 AI Threat Tracker report, 'From Prompting to Autonomy: The Evolution of Adversarial AI,' documenting a fundamental shift in adversarial AI usage from basic prompting toward autonomous agentic workflows. Based on Mandiant incident response engagements, threat actor tracking, and live platform defenses, the report identifies five key trends: (1) expanding software supply chain risks targeting AI coding assistants and MCP servers; (2) targeting of proprietary AI research and models; (3) a shift toward agentic AI frameworks autonomously managing scanning pipelines, error resolution, and credential harvesting at scale; (4) AI-augmented multi-stage attack lifecycle support; and (5) illicit account procurement and LLMJacking operations.

The report's most significant finding is a Q2 2026 case involving a financially motivated threat actor who compromised an organization's cloud infrastructure and used an AI coding chatbot, a prompt, and preconfigured Markdown instruction sets to plan, build, and deploy an autonomous multi-agent attack framework. The framework completed a mass credential-harvesting campaign in under six hours, autonomously managing the vulnerability scanning pipeline, performing real-time troubleshooting, and executing IP rotation logic by routing attack traffic through the victim's legitimate cloud IP addresses. The campaign compromised thousands of third-party credentials, demonstrating the compression of human-in-the-loop latency and the narrowing of defender response windows.

Separately, GTIG discovered an exposed C2 server hosting a framework codenamed 'Recon' — an automated reconnaissance and credential management framework. Directory listings exposed specialized agentic configuration files including AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, and the modular framework directories .openclaw/ and memory/. Within a short period after detection, Recon had transitioned to a live production frontend dashboard managing over 23,800 harvested secrets in real time, including API keys for cloud services and AI platforms, organized, validated, and managed. GTIG assessed this as a critical evolution from passive, endpoint-focused infostealers to offensive agentic harvesting.

The report documents two PRC-nexus state-sponsored cyber espionage cases. In the first, a PRC-nexus group used Gemini to design a dynamic, automated penetration testing framework with an agentic architecture capable of observing target state, reasoning through actions, and executing in unpredictable environments. Planned discovery functions included port scanning and service parsing. GTIG disabled associated assets before deployment. In the second case, another PRC-nexus group built an AI-assisted exploitation and post-exploitation pipeline using 'CC Switch' to route queries to Claude, Gemini, and Codex for writing custom exploit scripts, generating spear-phishing lures, and debugging errors. The pipeline used Burp Suite for web application probing and API mapping, the Phalanx open-source polyglot autonomous pentesting framework for automated exploitation routines at scale, and the Shai-Hulud framework for persistent C2, credential harvesting, and lateral movement.

Additional actors documented in the broader GTIG reporting include UNC6780 (TeamPCP), a financially motivated threat actor executing large-scale supply chain compromises of PyPI, npm, and Docker Hub, deploying the DUSTMAKER credential stealer with AI-interacting functionalities including hidden directory persistence in .claude/, .vscode/, and .cursor/ project directories, CI/CD OIDC token theft for SLSA Build 3 attestation abuse, and behavioral prompt injection against LLM security scanners. The PROMPTSPY Android backdoor with its GeminiAutomationAgent module represents the first known Android malware using generative AI for autonomous UI interaction, capable of capturing PINs, patterns, and biometric data via the Accessibility API. The report also notes distillation attacks exceeding 100 million prompts and the emerging LLMJacking trend where attackers compromise cloud infrastructure to provision unauthorized AI workloads.

GTIG assesses that while fully autonomous zero-day pipelines have not yet been observed in the wild, adversarial adoption of agentic AI is evolving toward this use case, and the open-source release of demonstrated attack frameworks will likely spur adversary emulation. Defensive responses include continuous model-level safeguards, targeted containment of bad actor assets, proactive disruption and legal action (including the first legal action over Gemini misuse), and Google's AI Threat Defense (AITD) architecture combining Gemini reasoning, Wiz risk prioritization, CodeMender automated remediation, and Mandiant frontline intelligence.

MITRE ATT&CK / ATLAS techniques by tactic:

Reconnaissance

AML.T0006 Active Scanning; T1589 Gather Victim Identity Information; T1595 Active Scanning

Resource Development

AML.T0008 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

Initial Access

AML.T0010 AI Supply Chain Compromise; AML.T0012 Valid Accounts; T1078 Valid Accounts; T1566 Phishing

AI Model Access

AML.T0040 AI Model Inference API Access

Execution

AML.T0051 LLM Prompt Injection; T1059.006 Python

defense-evasion

AML.T0054 LLM Jailbreak

Defense Evasion

T1027 Obfuscated Files or Information

Credential Access

T1552 Unsecured Credentials

Remediation

Immediate actions

  • Audit cloud infrastructure for unauthorized AI workloads and anomalous compute provisioning (GPU quota increases, AI Workbench notebooks, Cloud Run services with allUsers IAM binding)
  • Review and revoke exposed GitHub PATs, API keys, and cloud service account credentials
  • Deploy network detection rules for traffic to BaaS platforms (Supabase) from uncategorized or newly registered domains
  • Configure endpoint detection for hidden directories in .claude/, .vscode/, .cursor/ project paths
  • Block known malicious infrastructure indicators from GTIG IOC collections

Workarounds

  • Restrict outbound API access to AI/LLM services to authorized accounts only
  • Implement rate limiting and anomaly detection on AI API consumption patterns
  • Monitor for unauthorized AI account provisioning and LLM service enablement within cloud environments
  • Enforce MFA and conditional access policies for cloud console and AI platform administrative access
  • Review and restrict GitHub Actions OIDC token permissions to minimum necessary scope

Longer-term hardening

  • Implement AI Threat Defense (AITD) architecture combining frontier model reasoning with automated remediation
  • Deploy behavioral detection for agentic AI abuse patterns (mass credential harvesting, automated IP rotation through cloud infrastructure, autonomous vulnerability scanning chains)
  • Establish supply chain security scanning for AI tooling dependencies (MCP servers, PyPI packages, Docker images, VS Code extensions)
  • Implement SLSA Build 3 attestation verification with anomaly detection for OIDC token abuse patterns
  • Deploy prompt injection detection and harden LLM security scanners against adversarial embedding attacks

Timeline

  • HONESTCUE downloader/launcher framework calling Gemini API for C# code generation first observed; marks earliest known AI-integrated malware using commercial LLM API for just-in-time payload generation
  • COINBAIT phishing kit observed in the wild; masquerades as cryptocurrency exchange, built with Lovable AI platform, attributed to UNC5356; first documented use of AI low-code platform for credential harvesting infrastructure
  • ClickFix campaigns abusing AI share links (Gemini, ChatGPT, CoPilot, DeepSeek, Grok) first observed; threat actors host malicious command lines on AI platform sharing features to distribute ATOMIC infostealer targeting macOS and Windows
  • GTIG publishes first AI Threat Tracker report documenting APT and IO actors from DPRK, Iran, PRC, and Russia operationalizing AI, including model distillation attacks, HONESTCUE, and COINBAIT phishing kit
  • UNC6780 (TeamPCP) begins large-scale supply chain compromises of PyPI, npm, and Docker Hub; deploys DUSTMAKER credential stealer with AI-interacting functionalities including hidden directory persistence in .claude/ and .vscode/ and behavioral prompt injection against LLM security scanners
  • AI coding agent incorporates malicious cryptocurrency-themed dependency into active codebase for legitimate crypto trading project, demonstrating AI-assisted supply chain compromise confirmed by public research
  • LLMJacking operation detected: threat actor compromises exposed GitHub PAT, provisions Gemini Enterprise, creates rogue service accounts with Editor privileges, deploys LiteLLM API and Manus agent framework to publicly accessible Cloud Run, requests NVIDIA RTX 6000 GPU quota increases for unauthorized AI workloads
  • PROMPTSPY Android backdoor with GeminiAutomationAgent module discovered by ESET; first Android malware using Gemini API for autonomous UI interaction via Accessibility API, capturing PINs, patterns, and biometric authentication data
  • Exposed C2 server hosting 'Recon' framework discovered; directory listings include AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, .openclaw/, and memory/ directories; transitions to live production dashboard managing over 23,800 harvested secrets in real time including API keys for cloud and AI services
  • Google disrupts 'Outsider Enterprise', a China-based cybercrime service providing phishing kits for mass impersonation of Google/trusted brands; operators used Gemini to generate code at scale; first legal action over Gemini misuse sets precedent for platform provider action against AI tool abuse in fraud operations
  • Financially motivated actor compromises cloud infrastructure and deploys autonomous multi-agent credential harvesting framework; completes campaign in under six hours using AI coding chatbot, Markdown agent instruction sets, and automated IP rotation through victim cloud infrastructure, compromising thousands of third-party credentials
  • GTIG publishes Q3 2026 AI Threat Tracker 'From Prompting to Autonomy: The Evolution of Adversarial AI', documenting autonomous multi-agent credential harvesting, Recon framework, PRC-nexus Gemini pentest framework, and CC Switch AI-assisted exploitation pipeline

Sources cited

Previous and next in threat intel

Further reading

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats