Google study on AI misuse in APT and malware workflows
Technical Analysis
Summary
Hide ▲
Show ▼
On Feb. 12, 2026, Google Threat Intelligence Group and Google DeepMind said government-backed and financially motivated actors used AI across the attack lifecycle during late 2025. The report also highlighted PROMPTFLUX, an experimental VBScript malware from Nov. 5, 2025 that uses the Gemini API to rewrite and obfuscate code while trying to persist and spread. Google tied additional abuse to APT42, UNC2970, TEMP.Hex, APT31, Xanthorox, and Honestcue, along with model extraction attempts, jailbreak services, and ClickFix-style social engineering. Google said some activity was still under development, but the findings show AI was being used for reconnaissance, phishing, vulnerability work, and malware support.
Related Happenings
IPhone AI chatbot traffic leak of API keys, replayable tokens, and open relays
Technical Analysis
H score27
First: 30.06.2026 16:49
Last: 30.06.2026 16:49
Sources 1
About this happening:
LLMKeyLens testing found 444 iPhone AI chatbot apps leaking paid AI access, exposing API keys, replayable tokens, and open relays that let others bill mode...
IPhone AI chatbot traffic leak of API keys, replayable tokens, and open relays
Technical AnalysisAbout this happening: LLMKeyLens testing found 444 iPhone AI chatbot apps leaking paid AI access, exposing API keys, replayable tokens, and open relays that let others bill mode...
Google Cloud Vertex AI SDK Python predictable bucket squatting security flaw
Vulnerability
H score1
First: 16.06.2026 22:05
Last: 16.06.2026 22:05
Sources 1
About this happening:
Google Cloud Vertex AI SDK for Python had a predictable temporary bucket flaw that let an attacker hijack model uploads and reach code execution inside Google's servin...
Google Cloud Vertex AI SDK Python predictable bucket squatting security flaw
VulnerabilityAbout this happening: Google Cloud Vertex AI SDK for Python had a predictable temporary bucket flaw that let an attacker hijack model uploads and reach code execution inside Google's servin...
Google AI Threat Defense launch adds autonomous AI-attack detection and remediation for enterprises
Security Tool/Service
H score20
First: 28.05.2026 12:55
Last: 28.05.2026 12:55
Sources 1
About this happening:
Google Cloud launched Google AI Threat Defense, an always-on autonomous security platform aimed at stopping AI-powered cyberattacks across enterprise environments. The...
Google AI Threat Defense launch adds autonomous AI-attack detection and remediation for enterprises
Security Tool/ServiceAbout this happening: Google Cloud launched Google AI Threat Defense, an always-on autonomous security platform aimed at stopping AI-powered cyberattacks across enterprise environments. The...
Shai-Hulud worm clone activity on NPM
Malware Activity
H score69
First: 18.05.2026 12:45
Last: 18.05.2026 12:45
Sources 1
About this happening:
The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...
Shai-Hulud worm clone activity on NPM
Malware ActivityAbout this happening: The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...
Google GTIG analysis of adversary AI use for exploit development and attack orchestration
Technical Analysis
H score33
First: 11.05.2026 16:00
Last: 11.05.2026 16:00
Sources 1
About this happening:
Google Threat Intelligence Group published findings showing adversaries using AI for exploit development and attack orchestration, signaling that model-assisted tr...
Google GTIG analysis of adversary AI use for exploit development and attack orchestration
Technical AnalysisAbout this happening: Google Threat Intelligence Group published findings showing adversaries using AI for exploit development and attack orchestration, signaling that model-assisted tr...
Timeline
-
12.02.2026 14:45 3 articles · 5mo ago
Google publishes study on AI misuse by government-backed and criminal actors
Technical Analysis UpdateGoogle Threat Intelligence Group and Google DeepMind published findings on February 12, 2026 showing that government-backed cyber threat actors and financially motivated groups used AI across the attack lifecycle during the last quarter of 2025. The study described APT42 using generative AI to search for official email addresses and build reconnaissance on potential business partners, UNC2970 using Gemini to synthesize OSINT and profile high-value targets, TEMP.Hex using Gemini and other AI tools to compile target and separatist-organization intelligence, and APT31 using "expert cybersecurity personas" to automate vulnerability analysis and testing plans against US-based targets. Google also reported a rise in model extraction attempts, an underground jailbreak ecosystem, the Xanthorox toolkit advertising malware and phishing generation while relying on third-party and commercial AI products including Gemini, abuse of Gemini and OpenAI's ChatGPT public sharing features for ClickFix-style social engineering, and a September 2025 Honestcue case in which Gemini's API was used to dynamically generate and execute malicious C# code in memory.
Show sources
- Nation-State Hackers Embrace Gemini AI for Malicious Campaigns, Google Finds — www.infosecurity-magazine.com — 12.02.2026 14:45
- Nation-State Hackers Embrace Gemini AI for Malicious Campaigns, Google Finds — www.infosecurity-magazine.com — 12.02.2026 14:45
- Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly — thehackernews.com — 05.11.2025 17:33