A suspected financially motivated attacker used a multi-agent framework to scan for vulnerabilities and compromise thousands of third-party credentials in less than six hours, Google Threat Intelligence Group said in a report published Tuesday. The operation ran from cloud infrastructure the attacker had already compromised.
The actor built the framework with an AI coding chatbot, a prompt, agent instructions and preconfigured Markdown playbooks. Once running, the agents managed the scanning pipeline, corrected operational errors and rotated internet addresses without manual intervention. Sending traffic through the victim’s cloud environment gave the campaign legitimate source addresses.
Mandiant, Google’s incident-response unit, observed the operation during the second quarter. Google did not name the chatbot, the victim or the actor, and described the campaign as mass credential harvesting rather than a fully autonomous intrusion. A human still obtained the original cloud access and assembled the system before the agents took over scanning and collection.
The same report describes a separate exposed command-and-control server built to research vulnerabilities, scan infrastructure and manage stolen credentials. Its production dashboard organized more than 23,800 harvested secrets in real time, including keys for cloud and AI services. Configuration files named AGENTS.md, KNOWLEDGE.md and agentic_vuln_research.md appeared alongside directories for agent software. Google disabled assets connected to both operations.
The report also details activity by UNC6780, a financially motivated group also known as TeamPCP. Since March, the group has compromised software supply chains across PyPI, npm and Docker Hub. It published trojanized copies of Model Context Protocol servers and inserted malicious code into GitHub repositories that coding assistants could clone into developer environments.
UNC6780’s DUSTMAKER credential stealer places files in hidden directories used by Claude, Cursor and Visual Studio Code. Those files can create startup commands that execute when a developer opens the workspace. In continuous-integration systems, the malware extracts identity tokens from GitHub Actions runners and uses them to publish packages with valid cryptographic attestations.
Some DUSTMAKER samples also put prompt injections at the top of malicious JavaScript files. The text invokes biological and nuclear weapons, which Google assessed was intended to make LLM-based security scanners refuse to analyze the code beneath it. The technique targets the scanner’s safety policy rather than a software bug.
The findings follow a series of incidents in which agents helped ransomware operators after being told an intrusion was a simulation and obeyed malicious instructions split across separate inputs. OpenAI released GPT-6 Astra after rating its cyber capability Critical, with access to its offensive functions restricted.
Google said it has not yet observed a threat actor run a fully autonomous attack pipeline against targets in the wild. Its report separates that end-to-end threshold from operations in which agents already automate scanning, troubleshooting, credential collection and post-exploitation work after a person gains access.
Sources: Google Cloud, SiliconANGLE
–
By the Control Plane Editorial Team