Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)
Autonomous AI-agent frameworks automating credential theft (TL-2026-2390), also tracked as GTIG AI Threat Tracker Q3 2026, is a high-severity tracked intrusion set, first published 2026-09-08. It is attributed to PRC-nexus state-sponsored with medium confidence, maps to 16 MITRE ATT&CK / ATLAS techniques (AML.T0006, AML.T0008, AML.T0010), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-2390
- Threat ID
- TL-2026-2390
- Also known as
- GTIG AI Threat Tracker Q3 2026, From Prompting to Autonomy: The Evolution of Adversarial AI
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-09-08
- Last reviewed
- 2026-09-08
- Attribution
- PRC-nexus state-sponsored
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- technology, government administration, finance, defense, health, telecoms, academia
- Target regions
- Global, North America, Asia, Europe
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Autonomous AI-agent frameworks automating credential theft
Malware and tooling: DUSTMAKER, HONESTCUE, PROMPTSPY, SANDCLOCK, SOMBERMEME, Shai-Hulud, CC Switch, OpenClaw, Phalanx, Recon, Shai-Hulud
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker documents adversarial AI maturing from prompting toward autonomy: a financially motivated actor deployed an autonomous multi-agent framework that harvested thousands of third-party credentials in under six hours, and PRC-nexus actors used Gemini and CC Switch (Claude/Gemini/Codex) for exploit development and automated penetration testing. An exposed C2 server ran the 'Recon' framework, a production dashboard managing over 23,800 harvested secrets, signaling a shift from passive infostealers to offensive agentic harvesting.
How Autonomous AI-agent frameworks automating credential theft works
On September 8, 2026, Google Threat Intelligence Group (GTIG) published its Q3 2026 AI Threat Tracker report, 'From Prompting to Autonomy: The Evolution of Adversarial AI,' documenting a fundamental shift in adversarial AI usage from basic prompting toward autonomous agentic workflows. Based on Mandiant incident response engagements, threat actor tracking, and live platform defenses, the report identifies five key trends: (1) expanding software supply chain risks targeting AI coding assistants and MCP servers; (2) targeting of proprietary AI research and models; (3) a shift toward agentic AI frameworks autonomously managing scanning pipelines, error resolution, and credential harvesting at scale; (4) AI-augmented multi-stage attack lifecycle support; and (5) illicit account procurement and LLMJacking operations.
The report's most significant finding is a Q2 2026 case involving a financially motivated threat actor who compromised an organization's cloud infrastructure and used an AI coding chatbot, a prompt, and preconfigured Markdown instruction sets to plan, build, and deploy an autonomous multi-agent attack framework. The framework completed a mass credential-harvesting campaign in under six hours, autonomously managing the vulnerability scanning pipeline, performing real-time troubleshooting, and executing IP rotation logic by routing attack traffic through the victim's legitimate cloud IP addresses. The campaign compromised thousands of third-party credentials, demonstrating the compression of human-in-the-loop latency and the narrowing of defender response windows.
Separately, GTIG discovered an exposed C2 server hosting a framework codenamed 'Recon' — an automated reconnaissance and credential management framework. Directory listings exposed specialized agentic configuration files including AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, and the modular framework directories .openclaw/ and memory/. Within a short period after detection, Recon had transitioned to a live production frontend dashboard managing over 23,800 harvested secrets in real time, including API keys for cloud services and AI platforms, organized, validated, and managed. GTIG assessed this as a critical evolution from passive, endpoint-focused infostealers to offensive agentic harvesting.
The report documents two PRC-nexus state-sponsored cyber espionage cases. In the first, a PRC-nexus group used Gemini to design a dynamic, automated penetration testing framework with an agentic architecture capable of observing target state, reasoning through actions, and executing in unpredictable environments. Planned discovery functions included port scanning and service parsing. GTIG disabled associated assets before deployment. In the second case, another PRC-nexus group built an AI-assisted exploitation and post-exploitation pipeline using 'CC Switch' to route queries to Claude, Gemini, and Codex for writing custom exploit scripts, generating spear-phishing lures, and debugging errors. The pipeline used Burp Suite for web application probing and API mapping, the Phalanx open-source polyglot autonomous pentesting framework for automated exploitation routines at scale, and the Shai-Hulud framework for persistent C2, credential harvesting, and lateral movement.
Additional actors documented in the broader GTIG reporting include UNC6780 (TeamPCP), a financially motivated threat actor executing large-scale supply chain compromises of PyPI, npm, and Docker Hub, deploying the DUSTMAKER credential stealer with AI-interacting functionalities including hidden directory persistence in .claude/, .vscode/, and .cursor/ project directories, CI/CD OIDC token theft for SLSA Build 3 attestation abuse, and behavioral prompt injection against LLM security scanners. The PROMPTSPY Android backdoor with its GeminiAutomationAgent module represents the first known Android malware using generative AI for autonomous UI interaction, capable of capturing PINs, patterns, and biometric data via the Accessibility API. The report also notes distillation attacks exceeding 100 million prompts and the emerging LLMJacking trend where attackers compromise cloud infrastructure to provision unauthorized AI workloads.
GTIG assesses that while fully autonomous zero-day pipelines have not yet been observed in the wild, adversarial adoption of agentic AI is evolving toward this use case, and the open-source release of demonstrated attack frameworks will likely spur adversary emulation. Defensive responses include continuous model-level safeguards, targeted containment of bad actor assets, proactive disruption and legal action (including the first legal action over Gemini misuse), and Google's AI Threat Defense (AITD) architecture combining Gemini reasoning, Wiz risk prioritization, CodeMender automated remediation, and Mandiant frontline intelligence.
MITRE ATT&CK / ATLAS techniques used in TL-2026-2390
Reconnaissance
AML.T0006 Active Scanning; T1589 Gather Victim Identity Information; T1595 Active Scanning
Resource Development
AML.T0008 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
Initial Access
AML.T0010 AI Supply Chain Compromise; AML.T0012 Valid Accounts; T1078 Valid Accounts; T1566 Phishing
AI Model Access
AML.T0040 AI Model Inference API Access
Execution
AML.T0051 LLM Prompt Injection; T1059.006 Python
defense-evasion
AML.T0054 LLM Jailbreak
Defense Evasion
T1027 Obfuscated Files or Information
Credential Access
Remediation for Autonomous AI-agent frameworks automating credential theft
Immediate actions
- Audit cloud infrastructure for unauthorized AI workloads and anomalous compute provisioning (GPU quota increases, AI Workbench notebooks, Cloud Run services with allUsers IAM binding)
- Review and revoke exposed GitHub PATs, API keys, and cloud service account credentials
- Deploy network detection rules for traffic to BaaS platforms (Supabase) from uncategorized or newly registered domains
- Configure endpoint detection for hidden directories in .claude/, .vscode/, .cursor/ project paths
- Block known malicious infrastructure indicators from GTIG IOC collections
Workarounds
- Restrict outbound API access to AI/LLM services to authorized accounts only
- Implement rate limiting and anomaly detection on AI API consumption patterns
- Monitor for unauthorized AI account provisioning and LLM service enablement within cloud environments
- Enforce MFA and conditional access policies for cloud console and AI platform administrative access
- Review and restrict GitHub Actions OIDC token permissions to minimum necessary scope
Longer-term hardening
- Implement AI Threat Defense (AITD) architecture combining frontier model reasoning with automated remediation
- Deploy behavioral detection for agentic AI abuse patterns (mass credential harvesting, automated IP rotation through cloud infrastructure, autonomous vulnerability scanning chains)
- Establish supply chain security scanning for AI tooling dependencies (MCP servers, PyPI packages, Docker images, VS Code extensions)
- Implement SLSA Build 3 attestation verification with anomaly detection for OIDC token abuse patterns
- Deploy prompt injection detection and harden LLM security scanners against adversarial embedding attacks
Timeline of Autonomous AI-agent frameworks automating credential theft
- HONESTCUE downloader/launcher framework calling Gemini API for C# code generation first observed; marks earliest known AI-integrated malware using commercial LLM API for just-in-time payload generation
- COINBAIT phishing kit observed in the wild; masquerades as cryptocurrency exchange, built with Lovable AI platform, attributed to UNC5356; first documented use of AI low-code platform for credential harvesting infrastructure
- ClickFix campaigns abusing AI share links (Gemini, ChatGPT, CoPilot, DeepSeek, Grok) first observed; threat actors host malicious command lines on AI platform sharing features to distribute ATOMIC infostealer targeting macOS and Windows
- GTIG publishes first AI Threat Tracker report documenting APT and IO actors from DPRK, Iran, PRC, and Russia operationalizing AI, including model distillation attacks, HONESTCUE, and COINBAIT phishing kit
- UNC6780 (TeamPCP) begins large-scale supply chain compromises of PyPI, npm, and Docker Hub; deploys DUSTMAKER credential stealer with AI-interacting functionalities including hidden directory persistence in .claude/ and .vscode/ and behavioral prompt injection against LLM security scanners
- AI coding agent incorporates malicious cryptocurrency-themed dependency into active codebase for legitimate crypto trading project, demonstrating AI-assisted supply chain compromise confirmed by public research
- LLMJacking operation detected: threat actor compromises exposed GitHub PAT, provisions Gemini Enterprise, creates rogue service accounts with Editor privileges, deploys LiteLLM API and Manus agent framework to publicly accessible Cloud Run, requests NVIDIA RTX 6000 GPU quota increases for unauthorized AI workloads
- PROMPTSPY Android backdoor with GeminiAutomationAgent module discovered by ESET; first Android malware using Gemini API for autonomous UI interaction via Accessibility API, capturing PINs, patterns, and biometric authentication data
- Exposed C2 server hosting 'Recon' framework discovered; directory listings include AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, .openclaw/, and memory/ directories; transitions to live production dashboard managing over 23,800 harvested secrets in real time including API keys for cloud and AI services
- Google disrupts 'Outsider Enterprise', a China-based cybercrime service providing phishing kits for mass impersonation of Google/trusted brands; operators used Gemini to generate code at scale; first legal action over Gemini misuse sets precedent for platform provider action against AI tool abuse in fraud operations
- Financially motivated actor compromises cloud infrastructure and deploys autonomous multi-agent credential harvesting framework; completes campaign in under six hours using AI coding chatbot, Markdown agent instruction sets, and automated IP rotation through victim cloud infrastructure, compromising thousands of third-party credentials
- GTIG publishes Q3 2026 AI Threat Tracker 'From Prompting to Autonomy: The Evolution of Adversarial AI', documenting autonomous multi-agent credential harvesting, Recon framework, PRC-nexus Gemini pentest framework, and CC Switch AI-assisted exploitation pipeline
Sources cited for Autonomous AI-agent frameworks automating credential theft
- From Prompting to Autonomy: The Evolution of Adversarial AI
- AI agents in cyberattacks: automation on the rise, Google research finds
- Hackers build AI frameworks for widescale credential theft
- Google: AI Now Powers Every Threat Actor's Playbook
- Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use
- Adversaries Leverage AI for Vulnerability Exploitation / Initial Access
- PROMPTSPY: First Android threat to use Generative AI
- Adversarial Misuse of Generative AI
- MITRE ATLAS (Adversarial Threat Landscape for AI Systems)
- GTIG GRIDTIDE Campaign Disruption
More in threat intel
- Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass
- China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Models
- ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport Manager 12.44 (UAT-10820)
- OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and Scope Violations Found in Safety Testing
- Invisible Unicode Tag Characters Used to Evade Phishing Detection in Financial Scam Campaign
Detection coverage for TL-2026-2390
As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2390 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.