Google’s Threat Intelligence Group says criminal and state-backed adversaries are increasingly using artificial intelligence to automate and scale cyber operations. It cites TeamPCP using an AI coding chatbot, a prompt, and agent instructions to plan, build, and execute a mass credential-harvesting campaign in under six hours. Since March 2026, the group has targeted open-source services including PyPI, npm, and Docker Hub, and released malware that may encourage copycat activity.
Google also observed China-linked, Iran-backed, and North Korea-linked actors using AI for reconnaissance, social-engineering lures, malware development, exploitation, post-exploitation, influence operations, and cryptocurrency theft. Google says it disables associated projects and accounts and is deploying defenses against misuse and model extraction. The significance is that AI gives less-resourced attackers greater speed and reach while expanding the attack surface defenders must monitor.
https://www.securityweek.com/ai-is-giving-lesser-resourced-attackers-nation-state-level-reach-google-warns/
oxhak / Ox HaK
npub1sx…dz7z7
2026-09-09 17:06:21 UTC
Author Public Key
npub1sxexewvzysc3affq4yzzh7w8e3udyujap2vlj7t6lkdg5dvhp24q4dz7z7Seen on
wss://relay.damus.ioPublished at
2026-09-09 17:06:21 UTCEvent JSON
{
"id": "4525cd14eeddd75229e90d964ddf872d30ea8e48dbc62142b20e73e553bb2814",
"pubkey": "81b26cb98224311ea520a9042bf9c7cc78d2725d0a99f9797afd9a8a35970aaa",
"created_at": 1788973581,
"kind": 1,
"tags": [],
"content": "Google’s Threat Intelligence Group says criminal and state-backed adversaries are increasingly using artificial intelligence to automate and scale cyber operations. It cites TeamPCP using an AI coding chatbot, a prompt, and agent instructions to plan, build, and execute a mass credential-harvesting campaign in under six hours. Since March 2026, the group has targeted open-source services including PyPI, npm, and Docker Hub, and released malware that may encourage copycat activity.\n\nGoogle also observed China-linked, Iran-backed, and North Korea-linked actors using AI for reconnaissance, social-engineering lures, malware development, exploitation, post-exploitation, influence operations, and cryptocurrency theft. Google says it disables associated projects and accounts and is deploying defenses against misuse and model extraction. The significance is that AI gives less-resourced attackers greater speed and reach while expanding the attack surface defenders must monitor.\n\nhttps://www.securityweek.com/ai-is-giving-lesser-resourced-attackers-nation-state-level-reach-google-warns/",
"sig": "d29650bf1b8d360fe7cd1cb92637d87506d2e5d9de361579b2424c5d007c068e1be2caa4649a3504f74ef5469621cadf8aaba7c11425e2bea5dd39b212145a60"
}