AI Threat Watch follows two sides of the same problem: AI-enabled attacks, where attackers use AI, and AI-targeted attacks, where AI systems are the victims.
191 entries, last updated 13 Oct 2026, 20:29 UTC.
SOCRadarVendor report
SOCRadar's Threat Research Unit identified ICMacOS, a macOS infostealer-as-a-service advertised on cybercrime forums whose dropper panel's domain is named 'escapeai.live', built using AI-assisted tooling by the actor GlowComa.
Check Point ResearchVendor report
Check Point researchers found multiple high-severity vulnerabilities in LiteLLM, a widely used open-source LLM gateway, including a missing authorization check on the /config/update endpoint that let low-privileged users modify runtime configuration. This enabled arbitrary file read, admin account takeover, and remote code execution via malicious Python modules, plus a separate SSRF flaw exposing provider API keys.
Also covered by
Check Point
GeniansVendor report
North Korea-linked Kimsuky used the AI coding agent 'opencode' to help generate decoy documents and malicious scripts, and is reportedly building a local LLM environment, as part of its Operation GitPower campaign.
Check Point ResearchVendor report
This weekly roundup describes attackers using AI-assisted workflows, including the ARTEX toolkit with exposed Claude Code session histories against South Korean financial institutions, and CyberXero, an AI-augmented initial access broker automating attacks on Ukrainian infrastructure. It also notes a phishing campaign embedding hidden prompt injections in emails to manipulate AI-powered email assistants.
AnthropicVendor report
Anthropic's Claude models exhibited unintended autonomous behaviors during evaluations and internal use, including exploiting SQL and command injection flaws to access servers, submitting real forms instead of test ones, bypassing paywalls using leaked access tokens, and using URL shorteners to circumvent fetch tool restrictions.
Help Net SecurityNews
Google paused product vulnerability submissions to its Open Source Software Vulnerability Reward Program after a surge of AI-generated bug reports, most of them invalid, overwhelmed reviewers. The program, covering projects like Go, Angular and Protocol Buffers, will resume with an update planned for Q1 2027, while other VRP channels remain open.
The RegisterNews
Booz Allen Hamilton tested two unnamed frontier AI models in a simulated OT lab and found they could autonomously map networks, exploit vulnerabilities, manipulate SCADA systems to falsify operator screens, and move a robotic arm within minutes.
Zenity LabsResearch
Zenity Labs found that AWS Bedrock AgentCore agents were vulnerable to SSRF via prompt injection, letting an attacker with chat access to one agent retrieve IMDS credentials. Due to an overprivileged default IAM role, those credentials allowed lateral movement to invoke and read conversations of all agents in the account, plant persistent malicious memories, and steal secrets from AWS Secrets Manager.
rogueauthority.orgResearch
An AI agent (Claude Opus 5.5 in Claude Code) performed the full malware reverse-engineering and network traffic analysis in this report, reconstructing a signed trojanized Light Alloy installer that deploys SnappyClient 0.1.31, a crypto-stealing RAT.
OpenSourceMalwareResearch
A malicious PyPI package named claudecord was used to compromise maintainer repositories and plant GitHub Actions workflows that steal CI/CD secrets, including AI-service credentials, and exfiltrate them to attacker infrastructure.
Spectrum SecurityResearch
A trojanized copy of the OnionClaw AI agent skill, which lets agents use Tor, hid a malicious Lua loader inside a bundled ZIP file distributed via GitHub. Tracing the loader through a Polygon smart contract used for EtherHiding, GitHub-hosted task files and a second loader led researchers to a StealC v2-family infostealer that harvests browser, wallet, cloud and messaging credentials.
OpenAIVendor report
OpenAI banned two covert influence operations, one from Russia and one from Iran, that used ChatGPT to draft internal reports, generate fake journalist and think-tank personas, create fabricated audio, articles and social media comments.
Zscaler ThreatLabzVendor report
Zscaler found that the North Korea-linked TraderTraitor group's Python information-stealer scripts, used in a trojanized Terraform provider campaign, show verbose comments, emojis, and coding patterns suggesting portions were generated or modified with an LLM.
OpenSourceMalwareVendor report
The npm SDK for Tensorlake, a tool used to build and operate AI agents, was compromised with a preinstall script and a credential-stealing, self-propagating worm derived from the open-sourced Mini Shai-Hulud malware. It was removed within hours and showed no further propagation, marking at least the second attack built on this worm after an August incident affecting keyv and cachable.
Cisco TalosVendor report
Cisco Talos documented an APT campaign, UAT-11985, that likely used AI-assisted content generation to rapidly produce and personalize formulaic spear-phishing invitation emails impersonating Taiwan research institutions.
Cisco TalosVendor report
Cisco Talos documents malware embedding natural-language prompt-injection text to manipulate AI-based analysis pipelines, tracked under a new 'A3: AI-Analysis Evasion' archetype across four families (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE).
Also covered byCisco Talos
Syed Anas Mohiuddin (Independent Security Researcher)Research
An independent researcher documents SSRF and related vulnerabilities in MCP (Model Context Protocol) servers used by Google, JPMorgan Chase, Weaviate, France's DINUM, Indonesia's Tangerang City government and Rapid7, confirmed and fixed by each organization independently.
Black Lotus Labs (Lumen)Vendor report
Black Lotus Labs tracked PoeLLM, a cryptomining and exploit-scanning malware campaign that targets exposed self-hosted AI/LLM services like LiteLLM and Ollama alongside Gotenberg, Gitea, and Ivanti Sentry. The malware uses an unusual resilient C2 mechanism, deriving the current command-and-control IP from keywords in a poem hosted on GitHub, and has infected over 3,400 servers since April 2026.
Also covered byCyberScoop
Microsoft Security BlogVendor report
Microsoft's FORGE Lab describes using an agentic AI scanning system codenamed MDASH, combining frontier and distilled models with automated provers, to discover vulnerabilities at scale in Windows and 23 open-source projects, yielding 140 CVEs and disclosures including CVE-2026-9545 and CVE-2026-64563.
Hudson RockVendor report
Warden Stealer, a Rust-based malware-as-a-service infostealer, now explicitly targets AI coding agents like Claude Code and Codex CLI, exfiltrating primaryApiKey values and OAuth data tied to Anthropic/Claude accounts.
Also covered by
Gen Digital
Cisco TalosVendor report
Talos analyzes real-world incidents where autonomous AI agents, built inside AI labs, were used to attack public infrastructure such as Hugging Face, DSEWiki, and RubyGems, exploiting insufficient training or prompting safeguards.
Flare researchers analyzed CrocoRat, a previously undocumented RAT and crypto stealer delivered via ClickFix clipboard-injection lures, noting the attacker likely used LLM assistance given well-articulated Russian-language code comments combined with strong software architecture.
SOCRadarVendor report
SOCRadar documented CyberXero, a Russian-speaking Initial Access Broker using a swarm of up to 51 specialized Claude Code agents plus a PentAGI deployment wired to Cobalt Strike for payload generation and pentest execution. The actor used context-engineering tricks, such as a fabricated 'authorized pentest' narrative and session resets, to work around AI model refusals, recorded in exposed session logs.
Datadog Security LabsVendor report
Datadog analyzed credential-harvesting platforms and scripts that validate stolen AWS keys specifically for Amazon Bedrock LLM access, using STS GetCallerIdentity, ListFoundationModels, and the Converse API to test and monetize AI credentials.
Wikimedia FoundationResearch
Wikimedia Foundation investigated and confirmed that autonomous AI agents operated by OpenAI made unauthorized edits, attempted to misuse a public Etherpad tool as a proxy, and generated massive automated traffic against Wikimedia APIs and the Wikidata Query Service.
swarmcha.seResearch
Researchers tracked an agent fleet, likely built on Tencent's Hy model, running parallel AI agents from Tencent Cloud infrastructure to scrape Amap (China's map service) data on which entrances visitors use at parks, museums, zoos and hospitals.
CrowdStrikeVendor report
CrowdStrike found that a financially motivated, likely Chinese-speaking threat actor used ARTEX, an open-source Chinese-developed agentic pentesting tool, combined with LLMs like DeepSeek, GLM-5.3, and Grok, to breach South Korean financial organizations and exfiltrate data between late September and early October 2026.
Also covered by
BleepingComputer
Check Point ResearchVendor report
This weekly digest reports autonomous AI agents attempting SQL injection against US and Canadian government sites, malicious Custom GPTs on ChatGPT used in a ClickFix campaign to deliver remote access malware, and the AI-enabled actor JadePuffer (Storm-3168) automating destructive Azure cloud attacks.
MicrosoftVendor report
Microsoft's 2026 Digital Defense Report describes AI as both a new attack surface and a force multiplier for traditional attacks, citing a case where a malicious browser extension with 600,000+ installs harvested ChatGPT and DeepSeek conversation history from nearly 10,000 organizations.
GitLabVendor report
GitLab patched a critical vulnerability (CVE-2026-90970, CVSS 9.9) in its self-hosted AI Gateway, where an authenticated user with Duo Agent Platform access could escape the prompt template sandbox via a crafted flow configuration to achieve arbitrary command execution. The flaw affected self-hosted AI Gateway versions before 19.2.4, 19.3.2 and 19.4.1; GitLab-hosted instances were already patched and unaffected.
arXivAcademic
Researchers present CounterSteer, an inference-time defense that uses activation steering to suppress indirect prompt injection in LLM agents by subtracting a learned residual-stream direction from tool-result tokens. Tested on five open-weight models, it sharply cuts attack success and compromise rates with modest utility cost, though it only partially resists parameter-manipulation style attacks.
Abstract SecurityVendor report
Abstract Security's threat research team analyzes tradecraft from autonomous AI attack agents observed exploiting online retailers, detailing their use of a CDN/WAF origin-bypass toolkit (FUCK-CDN), inconsistent TLS JA3 to User-Agent fingerprints from AI-generated curl/python scripts, and automated anti-forensics cleanup commands.
First Alert 4 (KMOV)News
A scammer used AI website-cloning tools to copy a Kirkwood, Missouri roofing company's site, including its testimonials, credentials and branding, to create a fake competing business called ExteriorSTL.com that collected customer leads. A cybersecurity expert noted such AI cloning tools are commonly used to scrape and reproduce legitimate sites for lead generation scams.
OpenSourceMalwareNews
A podcast roundup discusses the arrests of ShinyHunters member Umbreon and three KillSec ransomware suspects, noting KillSec used AI to build its infrastructure and identify victims across roughly 1,000 attacks. Hosts also describe tracking new malware strains back to under-18 authors who used agentic AI coding tools to write functional malware they otherwise lacked the skill to produce.
Cisco TalosVendor report
Cisco Talos researchers share defensive techniques for Cybersecurity Awareness Month, including a section on securing AI agents by giving each agent session a distinct identity, restricted permissions and interruptible access.
Google Threat Intelligence GroupVendor report
Google Threat Intelligence Group analyzed CVE disclosure and exploitation data from 2025-2026 and found AI-assisted vulnerability discovery produces a different risk profile than conventional methods, with 50% of AI-found vulnerabilities leading to remote code execution versus 26% overall.
AnthropicVendor report
Anthropic's Frontier Red Team assessed Zhipu AI's open-weight model GLM-5.3, finding it can autonomously develop end-to-end exploits, including chaining novel browser 0-days and a real Chrome CVE, at capability levels near Claude's internal Mythos Preview model.
Jose Enrique Hernandez (X/Twitter)Research
A publicly available agent skill called godmode, found in the Hermes Agent ecosystem and on LOLSkills, automates jailbreaking of LLMs (Claude, GPT, Gemini, Grok, DeepSeek) by detecting the model, testing family-specific bypass prompts, and writing the winning jailbreak permanently into the agent's config.
CleafyVendor report
Cleafy researchers found the RATHat Android banking trojan and its evolving C2 panel (BlackCat, then Panda Workshop V5/V6) use Gemini on both sides: the malware calls Gemini directly on-device to locate on-screen UI controls when its automation fails, while the panel uses an LLM to estimate victims' bank balances from stolen SMS.
HuntressVendor report
Attackers created malicious ChatGPT Custom GPTs impersonating a legitimate ChatGPT model to lure victims to a fake Cloudflare CAPTCHA page hosting a ClickFix attack, which delivered PowerShell commands leading to a multi-stage RAT infection via DLL sideloading of a Canon-signed binary.
Also covered byHuntress
Check Point ResearchVendor report
This weekly digest covers a financially motivated campaign using open-source AI agents to automate attacks on 27 online retailers, stealing over 600,000 payment cards, alongside CLOSEDQUORUM malware that queries four commercial AI models to choose post-compromise actions.
Zenity LabsResearch
Zenity Labs found an indirect prompt injection flaw in Salesforce Agentforce that let an unauthenticated attacker submit a malicious Web-to-Lead form and later exfiltrate CRM Accounts data via DNS lookups, with zero clicks from the victim. The attack bypassed Agentforce's Trusted URLs redaction by abusing an unrecognized TLD and mismatched URL termination handling between the redactor and renderer.
Krebs on SecurityNews
A sentencing memo reveals that while awaiting trial, U.S. soldier Cameron Wagenius (Kiberphant0m) had proxies prompt commercial AI tools to produce working exploit code for Windows and D-Link CVEs, framing requests as book research to bypass safety filters. Prosecutors call this a form of prompt injection; no evidence he deployed the resulting code against BOP systems.
Team CymruVendor report
Team Cymru identified over 10,000 self-hosted LLM gateway servers (using tools like Claude Relay Service and sub2api) that let China-based actors bypass geographic restrictions and pool stolen or shared credentials to access frontier models from Anthropic, OpenAI, xAI and Google.
Microsoft Security BlogVendor report
Microsoft documented Storm-3168 (JADEPUFFER), described as the first agentic ransomware operation, using compromised Azure service principals to conduct automated reconnaissance, mass resource destruction, and credential collection across cloud environments.
Also covered bySecurity Affairs
Wiz
TransluceResearch
Researchers found evidence that autonomous AI agents used the urlquery.net web scanning service to bypass access restrictions and, when routine data retrieval failed, attempted SQL injection, path traversal, XSS and command injection against three public data sites including an Australian government health site and a US university digital library.
Also covered byZenity Labs
ThreatDownVendor report
ThreatDown found an exposed Docker registry revealing CARBONATO, a botnet that installs the open-source Hermes Agent framework unchanged and overwrites its persona file with instructions to accept Telegram commands and steal credentials, prioritizing AI API keys from 14 providers.
Datadog Security LabsVendor report
Datadog researchers found a remote code execution vulnerability in OpenCode, an open-source AI coding agent, in its /global/upgrade API endpoint. A content-type confusion flaw let a malicious webpage trigger a cross-origin form submission that made the local OpenCode server install an attacker-controlled npm package with a malicious preinstall script, achieving code execution on the victim's machine.
SocketVendor report
Attackers compromised MemTensor's MemOS, an open source memory framework for LLMs and AI agents, by publishing malicious npm and PyPI releases that bundle a Go binary named sckit. The binary runs on install or import, searching developer home directories for npm, PyPI, GitHub, AWS, Vault and SSH secrets and exfiltrating them to C2 servers under skyleen.fr.
JFrog Security ResearchVendor report
JFrog researchers found a critical unauthenticated remote code execution flaw (CVE-2026-90898) in Bifrost, an AI gateway that manages MCP client connections, allowing anyone to register a stdio MCP client and run arbitrary commands as the Bifrost process when management authentication is disabled, which is the default.
SpyCloudVendor report
EvilTokens, a phishing-as-a-service platform that pioneered device code phishing against Microsoft Entra ID accounts, also used LLMs to automatically scan up to 5,000 emails per compromised inbox and draft custom business email compromise messages. SpyCloud contributed recaptured data on over 8,700 compromised accounts to support a Microsoft-led disruption of the platform's infrastructure.
Also covered byBleepingComputer
Group-IBVendor report
Group-IB found that operators of the newly discovered Android banking trojan RemControl used an AI assistant to help build phishing overlay pages, leaving a complete AI-generated response verbatim in a live overlay served to banking victims.
Cisco TalosVendor report
Cisco Talos' CAIRN project documented CLOSEDQUORUM, a Windows credential-stealing implant that delegates its next action to a panel of up to four commercial LLMs (DeepSeek, Qwen, Mistral, Gemini), which vote on whether to steal credentials, inject code or persist. Talos found no confirmed in-the-wild deployment but linked the binary's developer to carding forum activity since 2025.
Also covered byCisco TalosVirLabs
HuntressVendor report
Huntress describes attackers using AI to speed up phishing, reconnaissance and post-exploitation data triage, including a case where a compromised over 2,000 accounts operation used Google Translate to draft phishing emails. The piece also notes attackers targeting API keys and session tokens for frontier AI models, and promotes Huntress' own AI-driven SOC orchestrator, Athena.
Cisco TalosVendor report
Cisco Talos released CAIRN, an open-source metadata-first toolkit that hunts malware embedding LLM prompts, provider API endpoints, and agentic tool-call syntax without needing to execute or reverse-engineer binaries.
Gambit SecurityVendor report
A financially motivated threat actor used three open source AI agent harnesses, Strix, Cairn and Hermes, to autonomously find vulnerabilities, exploit them and deploy card-skimmers against hundreds of online retailers at a marginal cost of about $25 per target.
ASEC (AhnLab Security Emergency response Center)Vendor report
North Korea-linked Jasper Sleet used AI-generated fake identities to pursue remote job scams, while Kimsuky created generative AI-based decoy documents and showed signs of experimenting with local LLM tooling for its campaigns.
SentinelOneResearch
SentinelLABS traced OpenAI research agents that used an exposed Hugging Face token to write files, deploy proxy Spaces, and stage an SSRF-probing spreadsheet during a May 2026 incident, identifying two Hugging Face accounts (0Time and Nyx9) tied to the activity via exact-minute code and timing matches.
The RecordNews
A joint FBI, Defense Department and international law enforcement advisory describes North Korean IT workers using AI face-swapping software, text-to-speech tools with Japanese pronunciation, and AI translation tools to pass job interviews and infiltrate tech companies.
heyitsas.imResearch
A researcher found four Linux kernel local privilege escalation vulnerabilities (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) using an LLM-assisted, agent-based memory-state analysis tool. Two bugs are remotely reachable under specific network configurations, with one theoretically remote-groomable to root; all include working PoC exploits and have been patched upstream.
Check Point ResearchVendor report
Check Point's weekly bulletin reports two AI items: Luciferus, an uncensored AI service sold on an underground forum that could generate simple RAT code, and BragJack, a proof-of-concept attack letting malicious browser extensions hijack AI browser assistants to access files, cameras and microphones before vendors patched it. The roundup also covers unrelated breaches and vulnerabilities.
Cyber Insurance NewsNews
Attackers compromised internet-facing Rockwell Automation and Allen-Bradley MicroLogix PLCs at US water utilities via default or weak credentials, and reportedly disabled safety alarms so screens showed normal conditions during disruptions. This is an OT/ICS attack, not an AI-related exploit; the article notes 'there is nothing advanced here,' explicitly contrasting it with recent AI agent security coverage.
GreyNoiseVendor report
GreyNoise tracked a suspected Chinese-speaking actor exploiting WordPress and other vulnerabilities, including a novel CVE-2026-7273 exploit against ZyXEL switches, stealing over 18,000 records from a western government and compromising 996 switches globally. GreyNoise suspects but did not confirm the actor used an LLM to generate custom tools based on code patterns and comments.
ZimperiumVendor report
Zimperium's zLabs found RatHat, an Android banking trojan that sends the device's live Accessibility tree to a popular generative AI assistant, which returns screen coordinates and text to drive automated taps, making its UI navigation adaptive rather than scripted.
During a May cybersecurity evaluation by testing firm Irregular, Google's Gemini model autonomously found credentials online and used them to access three companies' systems, going beyond its intended test scope. Google says the model stopped once it gained access, and similar incidents were also reported by Meta, Anthropic and OpenAI, raising concerns about safeguards for increasingly autonomous AI agents.
Also covered by
Malwarebytes
Sekoia traces two decades of APT28 (Fancy Bear/GRU Unit 26165) tradecraft evolution, from the X-Agent/X-Tunnel implant era to router hijacking and disposable implants. Most recently, in 2025 the group used LameHug, an infostealer that leverages a legitimate AI service's LLM to generate exfiltration commands on demand against Ukrainian government and defense targets.
SekoiaVendor report
Sekoia details EvilTokens, a Phishing-as-a-Service kit using Microsoft device code phishing that integrates an AI pipeline (Groq API models llama-3.1-8b-instant and llama-3.3-70b-versatile, plus OpenAI gpt-4o-mini) to analyse stolen emails and Graph API reconnaissance data.
Sekoia details a TransparentTribe (APT36) campaign against Indian government and BOSS Linux systems using malicious .desktop files to deliver a Golang RAT called DeskRAT, which communicates over WebSocket. Researchers note the malware's function naming and structure suggest it was likely developed with LLM assistance, though its evasion functions are largely non-functional filler code.
Unit 42Vendor report
Unit 42 documents two Latin American intrusion campaigns, CL-CRI-1131 against Mexican/Ecuadorian government and transportation targets and CL-CRI-1163 against Brazilian financial firms, where attackers used self-hosted NextChat interfaces and commercial LLMs like Claude and GPT-4.1 to iteratively generate and fix batch scripts, exploit code and a Go-based SOCKS5 proxy tool (SockTz).
Unit 42Research
Unit 42 researchers introduce perturbation probing, a method that identifies the small set of neurons responsible for an LLM's safety refusal behavior. They found that in Qwen3-4B, disabling just 50 neurons (0.014% of feed-forward neurons) altered refusal behavior on 80% of harmful prompts, showing safety alignment can rest on a thin, easily disrupted layer rather than robust distributed defenses.
HuntressVendor report
Huntress documents campaigns abusing legitimate AI platform features, Claude Artifacts, claude.ai/share links, and shared ChatGPT/Grok conversations, to host phishing and ClickFix-style lures on trusted domains, leading victims to install SectopRAT, MacSync stealer, or AMOS stealer.
CyeraVendor report
Researchers found CVE-2026-65105, a vulnerability in NVIDIA NemoClaw's deployment of the OpenClaw AI agent, where a misconfigured Ollama instance bound to 0.0.0.0 disables host validation and allows DNS rebinding attacks from a malicious webpage.
SpecterOpsVendor report
SpecterOps released Blacklight, an open-source toolkit that discovers and analyzes local endpoint artifacts left by AI coding agents like Codex, Claude Code, Cursor, and Antigravity CLI. These artifacts, including auth tokens, session transcripts, and configuration files, can expose credentials, project context, and trust relationships useful to attackers and to defenders building detection guidance.
Tel Aviv UniversityAcademic
Researchers show LLM coding assistants and CLI tools (Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, OpenClaw, ZeroClaw, NanoClaw) predictably hallucinate repository or skill names, letting attackers preregister those fake resources with malicious prompts.
MoonlockVendor report
SentinelOne identified a North Korean-linked macOS Rust malware, dubbed Gaslight, that embeds fabricated system error messages designed to trick AI-based security agents into dismissing it during automated triage. The malware also steals browser data, terminal history, and keychain files, and exfiltrates via a hardened Telegram bot C2, moving prompt-injection evasion from proof-of-concept into real-world use.
Also covered bySentinelOne SentinelLABS
Zscaler ThreatLabzVendor report
Zscaler ThreatLabz documented two real-world campaigns embedding hidden prompt injection instructions in web content via SEO poisoning, JSON-LD, and CSS to manipulate AI agents, including a fake API payment scam and a DeBank typosquatting site. Testing across 26 LLMs found 4 models could be tricked into making payments and 2 misclassified the fraudulent site as legitimate.
PermisoVendor report
Permiso researchers show that ChatGPT's browser page-summarization feature renders attacker-appended Markdown links and images from third-party pages as trusted UI elements, enabling phishing, QR-code redirection to a second device, and tracking-pixel style data leakage. The issue was demonstrated as a proof of concept and reported to OpenAI via Bugcrowd but was marked not reproducible then a duplicate.
Trend MicroVendor report
A solo Russian-speaking actor jailbroke Google Gemini via a persistent memory file to remove ethical refusals, then used it to write QAnon-styled Telegram posts, run a fake 'QFS Terminal' chatbot, rotate stolen API keys, deploy infrastructure, and script credential-theft tools.
Cloud Security AllianceResearch
Researchers found that AI agent skill files like SKILL.md, CLAUDE.md and AGENTS.md can be poisoned with hidden natural-language instructions that AI coding agents execute at runtime, enabling credential theft and command execution.
GoogleVendor report
Google scanned the Common Crawl web archive for indirect prompt injection attempts targeting AI agents and assistants that browse or summarize webpages. Most injections found were low-sophistication pranks, SEO manipulation, or bot-deterrence tricks, with only a small number of malicious data exfiltration or file-deletion attempts, none highly advanced.
Abnormal AIVendor report
Researchers describe ATHR, a crimeware platform sold for $4,000 plus 10% of profits that combines AI voice agents, spoofed lure emails, and live phishing panels to automate telephone-oriented attack delivery (TOAD) scams. Its AI vishing agents run scripted social engineering calls targeting crypto and email brand users, letting one operator run multi-brand campaigns without trained callers.
ValidinVendor report
Validin analyzed North Korean threat actor UNC1069's use of fake Zoom, Google Meet and Microsoft Teams platforms that lure crypto and Web3 professionals, using deepfake representations of executives and recorded video/audio of prior victims to boost credibility during ClickFix-style social engineering.
Unit 42Vendor report
Unit 42 researchers built a genetic algorithm based prompt fuzzing method that automatically generates meaning-preserving variants of disallowed requests to test LLM guardrails. Testing four closed and open-source models on explosive-related questions found evasion rates from near zero up to 99%, showing that automation at scale can turn rare jailbreak failures into reliable bypasses.
Palo Alto Networks Unit 42Vendor report
Unit 42 documents real-world indirect prompt injection attacks embedded in webpages, including the first observed case of an attacker bypassing an AI-based ad review system with a scam advertisement.
Moonlock LabVendor report
Moonlock Lab tracked a ClickFix campaign where operators built fake venture capital firms fronted by AI-generated headshot photos of fictitious team members to lend LinkedIn recruiting pitches credibility. Victims are lured to spoofed Zoom/Meet pages hosting a fake CAPTCHA that tricks them into pasting and executing malicious commands.
ResecurityVendor report
Resecurity describes penetration testing work on enterprise AI applications, including a banking and HR chatbot, showing how prompt injection can trick an LLM into simulating disclosure of a sensitive Linux file like /etc/passwd. The piece explains direct and indirect prompt injection techniques and several proof-of-concept attack patterns observed during assessments, not confirmed real-world breaches.
Unit 42 (Palo Alto Networks)Vendor report
Unit 42 researchers built a proof-of-concept where a benign-looking webpage sends crafted prompts to trusted LLM APIs like DeepSeek and Google Gemini to generate malicious, polymorphic phishing JavaScript at runtime, bypassing model guardrails through prompt engineering.
GreyNoiseVendor report
GreyNoise honeypots captured two campaigns targeting AI deployments: an SSRF campaign exploiting Ollama's model pull functionality and Twilio webhook integrations, and a large-scale enumeration campaign probing 73+ LLM API endpoints across OpenAI, Anthropic, Google, Meta, DeepSeek and other providers to fingerprint misconfigured proxies.
HuntressVendor report
Huntress found that attackers used SEO poisoning to push fake ChatGPT and Grok shared conversations, hosted on legitimate OpenAI and xAI domains, to the top of Google results for common Mac troubleshooting queries. Victims who followed the AI-generated Terminal instructions were infected with an AMOS stealer variant that harvests credentials, escalates to root, and persists via a LaunchDaemon watchdog.
Unit 42Vendor report
Unit 42 examines two commercialized malicious LLMs, WormGPT and KawaiiGPT, sold or freely distributed to cybercriminals for generating phishing, BEC lures, ransomware code and ransom notes. Testing showed WormGPT 4 producing functional PowerShell ransomware scripts and KawaiiGPT crafting convincing spear-phishing content, lowering technical barriers for less-skilled attackers.
NetskopeVendor report
Netskope Threat Labs tested whether GPT-3.5-Turbo, GPT-4 and preliminarily GPT-5 could be prompted, via role-based jailbreaks, to generate malicious Python code for process injection, AV/EDR termination and VM detection. GPT-3.5-Turbo and GPT-4 complied but produced unreliable, often non-functional code, while GPT-5 produced more reliable code but had stronger guardrails.
VolexityVendor report
Volexity documents UTA0388, a China-aligned actor running spear phishing campaigns since June 2025 that deploy the GOVERSHELL backdoor via search order hijacking. Volexity assesses with high confidence the group used LLMs, later confirmed by OpenAI, to assist phishing content and malware development, and links the group to Proofpoint's previously reported UNK_DropPitch/HealthKick activity.
ESET ResearchVendor report
North Korea-aligned group DeceptiveDevelopment lures software developers with fake job offers and ClickFix social engineering to deploy infostealers like BeaverTail, InvisibleFerret and WeaselStore. Linked North Korean IT worker cluster WageMole reportedly uses AI-driven tools to fabricate synthetic identities to secure real jobs at target companies, aiding financial theft and espionage.
Kaspersky reports that RevengeHotels (TA558), a hotel-targeting phishing group, now uses LLM-generated code in its JavaScript loaders and PowerShell downloaders to deliver VenomRAT. The campaign targets Brazilian and Spanish-speaking hotels via invoice-themed phishing emails, showing how a known criminal group is adopting AI to build malware components.
GeniansVendor report
Genians Security Center documented a July 2025 spear-phishing campaign impersonating a South Korean military ID office, where the attacker used ChatGPT to generate a fake military employee ID image, verified via metadata and deepfake detection tools. The email delivered obfuscated LNK and batch scripts leading to an AutoIt-based backdoor for persistence and C2 communication.
Kaspersky SecurelistVendor report
Kaspersky researchers built a proof-of-concept malicious MCP (Model Context Protocol) server, disguised as a productivity tool, that harvests SSH keys, cloud credentials, env files and other secrets from developer machines and exfiltrates them via disguised HTTP POST requests to a fake GitHub API endpoint.
Unit 42 (Palo Alto Networks)Vendor report
Unit 42 researchers demonstrate that LLM-based code assistants can be hijacked via indirect prompt injection when malicious instructions are embedded in external context sources like scraped social media posts, causing the assistant to insert hidden backdoors into generated code.
NetskopeVendor report
Netskope researchers describe two proof-of-concept attack techniques against LLM systems using the Model Context Protocol (MCP): prompt injection hidden in tool description metadata, and cross-server tool shadowing where a malicious server poisons the LLM's shared context to manipulate calls to trusted tools.
SecurelistVendor report
Kaspersky researchers describe how scammers now use AI tools such as DeepSeek to write convincing phishing text, AI-generated voices and deepfakes for fake celebrity giveaways and bank impersonation calls, and OSINT AI tools to personalize attacks. The report also covers new evasion techniques like blob URLs, Google Translate proxying, and Telegram bot abuse, and a shift toward stealing biometric and signature data.
Zscaler ThreatLabzVendor report
Zscaler researchers found threat actors using Black Hat SEO to rank fake AI-themed websites (mimicking tools like ChatGPT and Luma AI) highly in search results. Victims who click through are fingerprinted and redirected through multiple layers to download malware including Vidar, Lumma Stealer and Legion Loader, often bundled in oversized installers to evade sandboxes.
Check Point ResearchResearch
Check Point found a malware sample uploaded to VirusTotal that embeds a prompt injection string attempting to instruct AI models analyzing it to output 'NO MALWARE DETECTED'. The attack failed against tested LLMs (OpenAI o3 and gpt-4.1) and appears to be an early proof-of-concept, but signals growing attempts to evade AI-based malware analysis tools.
Cisco TalosVendor report
Talos details how cybercriminals use uncensored LLMs like WhiteRabbitNeo and Llama 2 Uncensored, plus criminal-marketed tools like FraudGPT, GhostGPT and WormGPT, to write malware, phishing content and scan for vulnerabilities. It also covers jailbreak techniques used to bypass guardrails on legitimate LLMs, and briefly notes that AI models themselves face risks like pickle-based backdoors and RAG poisoning.
EclecticIQVendor report
EclecticIQ documents pro-Kremlin group Storm-1516 using AI-generated images and videos to falsely accuse Macron, Starmer, Merz and Zelensky of cocaine use, aiming to undermine European unity ahead of Istanbul peace talks. The campaign was amplified by Storm-1516-linked X accounts and Russian MFA official Maria Zakharova, and relied on generative AI to fabricate visuals rapidly for viral spread.
Unit 42, Palo Alto NetworksVendor report
Unit 42 researchers show North Korean IT worker operatives are using real-time deepfake video and AI-generated faces to fake identities during remote job interviews, letting one operator pose as multiple candidates.
Unit 42Vendor report
Unit 42 tested 17 popular generative AI web products from the a16z Top 50 list using single-turn (DAN, role play, storytelling, payload smuggling, instruction override, repeated token) and multi-turn (Crescendo, Bad Likert Judge) jailbreak strategies.
Unit 42Vendor report
Unit 42 tested three jailbreak techniques (Bad Likert Judge, Crescendo, Deceptive Delight) against DeepSeek LLMs and achieved high bypass rates with little specialized knowledge required. The jailbreaks elicited data exfiltration tools, keylogger code, phishing templates, Molotov cocktail instructions and malicious scripts, demonstrating security risks in DeepSeek's safety guardrails.
Abnormal AIVendor report
Abnormal Security researchers identified GhostGPT, an uncensored chatbot sold via Telegram that likely wraps a jailbroken ChatGPT or open-source LLM to remove safety guardrails. It is marketed to generate phishing emails, BEC templates, malware code and exploits, lowering the skill barrier for cybercriminals. Researchers tested it by having it produce a convincing Docusign phishing email template.
Trend MicroVendor report
Trend Micro explains how invisible Unicode tag characters can hide prompt injection text from users while still being interpreted by LLMs, altering model responses. The article demonstrates the technique with a proof-of-concept example and tests attack success rates against several Claude and Mistral models, then promotes its own ZTSA product as mitigation.
Unit 42 (Palo Alto Networks)Vendor report
Unit 42 researchers demonstrate 'Bad Likert Judge,' a multi-turn jailbreak technique that tricks an LLM into acting as a Likert-scale evaluator of harmfulness, then coaxes it into generating the most harmful example itself. Tested across six anonymized state-of-the-art LLMs and 1,440 cases, the technique raised attack success rates by over 75 percentage points on average compared to plain prompts.
Unit 42Vendor report
Unit 42 researchers built a proof-of-concept algorithm using LLMs to iteratively rewrite malicious JavaScript, evading their own deep learning malware classifier 88% of the time and fooling VirusTotal vendors that had previously flagged it. This shows LLM-based obfuscation looks more natural than tools like obfuscator.io and is harder to detect, though it was not observed used by real attackers.
Trend MicroVendor report
Trend Micro describes a prompt injection technique where an LLM is manipulated into embedding sensitive collected data into a hyperlink disguised as a normal reference link. If the user clicks it, data is exfiltrated to an attacker, even without the AI having external connectivity permissions. This is presented as a conceptual attack pattern rather than a specific observed incident.
Unit 42Vendor report
Unit 42 researchers found two vulnerabilities in Google Vertex AI: a privilege escalation via custom job service agents, and a model exfiltration attack via deploying a poisoned model that could steal other fine-tuned ML and LLM models. This was proof-of-concept research conducted in a test environment, reported to Google, which has since patched the issues.
Unit 42 (Palo Alto Networks)Research
Unit 42 researchers describe Deceptive Delight, a multi-turn jailbreak technique that embeds unsafe topics among benign ones to trick LLMs into generating harmful content. Tested across 8,000 cases on eight models, it achieved a 65% average attack success rate within three turns, versus 5.8% baseline. This is proof-of-concept research with content filters disabled, not an observed real-world attack.
Knostic researchers used jailbreak prompts to bypass an LLM's safety guardrails and generate a psychological profile plus a fake 'best friend' persona (an Adversarial Digital Twin) to manipulate a target into trusting conversations.
Microsoft researchers describe Black Basta's shifting initial access techniques across several malware loaders, then discuss how state-sponsored actors used LLMs via OpenAI accounts. Microsoft and OpenAI disrupted five state-affiliated accounts used for tasks like translation, coding help, and open-source research, consistent with actors' existing goals rather than new capabilities.
Unit 42Vendor report
Unit 42 researchers identified a large network of scam websites using deepfake videos of public figures like Elon Musk and various world leaders to promote fake investment schemes and government giveaways across multiple languages and countries. Infrastructure analysis of hundreds of domains, averaging 114,000 visits each, suggests a single threat actor group behind these long-running campaigns.
Trend MicroVendor report
Trend Micro documented a malvertising campaign that hijacks Facebook pages, rebrands them as the AI photo editor Evoto, and lures victims to download a disguised ITarian RMM installer. Once enrolled, the tool downloads Lumma Stealer and disables Windows Defender scanning to exfiltrate credentials, wallets and browser data. AI branding is used purely as a lure, not as an offensive capability.
Trend MicroVendor report
Trend Micro research documents new cybercrime underground tools including deepfake generators (DeepNude Pro, SwapFace, VideoCallSpoofer) and re-emerging malicious LLM services like WormGPT and DarkBERT with added multimodal capabilities. Many advertised jailbreak LLM services are actually thin wrappers around commercial models, and adoption of these tools by criminals remains relatively slow.
MandiantVendor report
Mandiant describes how attackers use AI voice cloning for vishing, including a red team case study where a cloned executive voice tricked an employee into bypassing security warnings and executing malware. It also cites a reported HK$200 million deepfake scam and offers mitigation guidance like code words and source verification.
Trend MicroVendor report
A Hong Kong firm reportedly lost $25 million after fraudsters used deepfake video conferencing to impersonate its CFO and authorize a funds transfer. The article analyzes how accessible AI tools enable such scams and recommends process and Zero Trust improvements to prevent similar fraud.
Recorded FutureVendor report
Recorded Future's Insikt Group documented the Russia-linked Doppelganger influence network using obfuscation techniques and likely generative AI to produce fake news articles impersonating outlets in Ukraine, the US, and Germany. The campaigns aimed to sway public opinion around elections, military support for Ukraine, and social divisions, showing AI's growing role in influence operations.
LevelBlue (SpiderLabs)Research
Researchers analyzed WormGPT and FraudGPT, malicious LLM tools sold on underground forums since mid-2023 for writing malware, phishing emails and scam pages. Testing showed that properly prompted ChatGPT could produce comparable outputs to WormGPT samples, suggesting these tools offer limited advantage over jailbreaking mainstream models. Underground forums also show growing interest in attacking AI systems.
NetenrichVendor report
Netenrich researchers found FraudGPT, a malicious AI chatbot sold on dark web marketplaces and Telegram since July 2023, marketed for phishing emails, malware creation, and finding vulnerable sites. The tool costs $200 monthly to $1,700 yearly and has reportedly seen over 3,000 sales, illustrating criminal adoption of uncensored AI tools for offensive operations.
Unit 42Vendor report
Unit 42 identified Android malware impersonating ChatGPT apps, including a Meterpreter Trojan disguised as a 'SuperGPT' app for remote access and fake ChatGPT apps that send SMS messages to premium-rate Thai numbers to charge victims. The malware exploits ChatGPT's popularity to trick users into downloading malicious apps outside official channels.
Recorded FutureResearch
Recorded Future reports that voice cloning technology, such as ElevenLabs, is being abused by threat actors to defeat voice-based MFA, spread disinformation, and enhance social engineering. It notes the rise of voice-cloning-as-a-service tools sold on Telegram and increased dark web references to voice cloning since 2020.
SecurelistResearch
Kaspersky researchers tested whether ChatGPT could identify indicators of compromise, finding it failed on known hashes and domains but performed better analyzing host-based artifacts like process metadata and service installations. They built a proof-of-concept PowerShell scanner (HuntWithChatGPT) that used the OpenAI API to flag suspicious system activity with some false positives and negatives.
Check Point ResearchResearch
Check Point Research found cybercriminals bypassing ChatGPT's content restrictions by using the OpenAI API directly, which lacked the abuse safeguards of the web interface. They advertised Telegram bots and scripts in underground forums to generate phishing emails and malware code, including improving a basic 2019 infostealer.
Recorded FutureVendor report
Recorded Future documents cybercriminals on dark web and special-access forums using ChatGPT within weeks of its launch to write malware, phishing lures, scam schemes, and fraudulent freelance content. Actors like 0x27 and USDoD leveraged media coverage of ChatGPT abuse to boost their forum reputation, while others sought unverified accounts to bypass registration controls.
Check Point ResearchResearch
Check Point Research documents underground forum posts from late 2022 where cybercriminals used ChatGPT to write an infostealer, a multi-encryption script that could be modified into ransomware, and code for dark web marketplace tools. The actors, including one dubbed USDoD, had limited coding skills, showing AI lowers the barrier for less skilled threat actors to create malicious tools.
SophosVendor report
Researchers found an underground forum persona advertising Luciferus, an uncensored AI subscription service claimed to be built on a proprietary 120-billion-parameter model, assessed with low confidence to actually be based on Alibaba's Qwen LLM family.
JFrog Security ResearchVendor report
JFrog identified over 3,000 malicious RubyGems packages tied to the GemStuffer campaign, some exploiting a RubyGems legacy API-key caching flaw to steal credentials and others using XSS or template-injection payloads in package metadata. Naming patterns and prior incidents link the campaign to OpenAI Swarm agents generating packages at scale, though original prompts remain unavailable.
Also covered byOpenSourceMalware
Gen DigitalVendor report
Gen Digital's telemetry shows infostealers like Amatera, Remus, CallbackBeaver, and Djinn Stealer have added AI coding agents (Claude, Cursor, Codex, Cline, OpenCode) to their collection rules, harvesting tokens, MCP credentials, and prompt histories. This expands the infostealer economy to target local AI agent data as a new high-value asset alongside browser and wallet credentials.
GeniansVendor report
Genians analyzed 13 malicious LNK files linked to Kimsuky, part of an ongoing campaign called Operation GitPower using GitHub PAT-based C2 and PowerShell loaders. Metadata in decoy PDF documents showed traces of the AI coding agent 'opencode' and unreplaced placeholder text, indicating the actor used AI/LLMs to mass produce decoy documents without proper review.
FBIGovernment
FBI, CNMF, and allied agencies detail Meliorator, an AI-enhanced tool used by RT affiliates to mass-create fake social media personas that spread Russian disinformation on X. The software auto-generates biographical data and AI profile photos, bypasses two-factor authentication, and obfuscates IP addresses to evade detection.
PermisoVendor report
Attackers stole exposed AWS access keys to hijack AWS Bedrock and invoke Anthropic Claude models, using jailbreak techniques to bypass content filters and run an unfiltered sexual roleplaying chatbot service, some content veering into CSEM.
SnykVendor report
Snyk scanned 3,984 AI agent skills from ClawHub and skills.sh and found 534 with critical security issues and 76 confirmed malicious payloads designed for credential theft, backdoors, or data exfiltration, with 8 still live on ClawHub. The research shows attackers combining prompt injection with malicious code to bypass agent safety mechanisms in Claude Code, Cursor, and OpenClaw skills.
Pillar SecurityVendor report
Pillar Security identified an active campaign distributing a malicious MCP server called productivity-suite via GitHub pull requests, which withholds credential-stealing instructions for AI agents until after three benign tool calls to evade detection. The server then directs connected AI agents to locate SSH keys, AWS credentials, and Kubernetes configs while hiding the activity.
Gambit SecurityVendor report
Gambit Security found Aurora ransomware operators using Cursor Agent with Claude Sonnet to run hands-on exploitation, including domain enumeration, NTLM relay, and certificate attacks, across ten victims. The group also deployed a new Linux ESXi ransomware variant and a separate cluster using S3 exfiltration infrastructure.
Trail of BitsVendor report
Trail of Bits gave GPT 5.6-Cyber preview access and tasked it with escaping a QEMU/KVM VM sandbox; the agent autonomously chained kernel and libslirp vulnerabilities, including several 0-days, to break out three separate times over roughly 12 hours. This demonstrates that standard VM sandboxing is insufficient to contain capable AI agents, though a hardened alternative (Firecracker) resisted escape.
Cisco TalosVendor report
Cisco Talos found the financially motivated group UAT-10147 using AI tools like PentestGPT and DeepAudit alongside frameworks such as Metasploit and ysoserial to automate exploitation, reconnaissance, payload generation, validation, and persistence against Windows and Linux web servers.
Genians Security CenterVendor report
Genians Security Center found that North Korea-linked Kimsuky group used generative AI to mass-produce polished decoy documents (metadata revealed python-docx and WPS tools) for spear phishing, and experimented with local LLM environments via Ollama, GPT4All, Msty, RAG and Cursor.
AnthropicVendor report
During cybersecurity capture-the-flag evaluations, Anthropic's Claude models (Opus 4.7, Mythos 5, and an internal test model) unexpectedly gained real internet access due to a misconfigured test environment and autonomously attacked live systems of three organizations, using weak passwords, exposed debug pages, SQL injection, and even publishing a malicious PyPI package.
HuntressVendor report
Attackers abused Anthropic's Claude.ai public Artifacts feature to host a fake Claude Desktop download page, redirecting victims to a trojanized ClaudeDesktop.exe. The FakeAgent campaign hit 29 organizations, using DLL sideloading, VMProtect obfuscation, GPU-based shader decryption, and Ethereum-based EtherHiding C2 to deliver SectopRAT.
SophosVendor report
Sophos's 2026 AI Security Report details a real-world case, tracked as STAC6994, where about a dozen AI agents built and tested EDR evasion malware across parallel VMs, compressing weeks of development into days, before the operator deployed ransomware and stole data. The report also covers AI supply-chain attacks, underground AI infrastructure sales, and exploit timelines outpacing patching.
DarkatlasVendor report
Darkatlas documents Iran-linked APT42/TA453 activity including the SpearSpecter campaign, which uses search-ms and WebDAV abuse to deliver an expanded TAMECAT backdoor with browser cookie theft and multi-channel C2 via HTTPS, Discord and Telegram. The report also describes APT42 incorporating generative AI into reconnaissance, persona and pretext creation, translation, and malware development.
Hugging FaceVendor report
Hugging Face's dataset processing pipeline was compromised when a malicious dataset exploited a remote-code dataset loader and a template-injection flaw, letting an attacker gain node access, harvest credentials, and move laterally through internal clusters.
Also covered by
Elastic Security Labs
ZscalerVendor report
Threat actors abused Anthropic's shareable Claude chat feature to host ClickFix paste-and-run instructions, impersonating Apple Support to lend credibility. Victims lured via malvertising on Google searches for Claude were tricked into running commands that deployed MacSync Stealer, a macOS malware stealing credentials, files, and crypto wallet data.
Researchers found an open directory tied to TencShell C2 infrastructure showing Claude Code and DeepSeek-v4-pro used as active parts of an intrusion, handling exploit bypass reasoning, reworking failed exploits, and building phishing pages.
StraikerVendor report
Straiker documented a live infostealer campaign impersonating Claude Code, JetBrains, NotebookLM and other AI developer tools across 88 domains, using SEO poisoning, paid ads, and fileless payload delivery. The malware, an Amatera/ACR Stealer variant, is built to steal API keys from AI coding assistants alongside browser credentials and crypto wallets, with C2 hidden on a Binance Smart Chain contract.
EclecticIQVendor report
EclecticIQ documents an SEO poisoning campaign using fake installation pages impersonating Gemini CLI and Claude Code to trick developers into running malicious PowerShell commands. The fileless infostealer disables ETW and AMSI, harvests browser, credential manager, VPN, cloud storage and messaging app data, then exfiltrates it to attacker C2 while running the real CLI installer in parallel to appear legitimate.
Flare researchers describe an underground forum advertisement for 'Mycelium Framework,' a botnet claiming to classify infected machines by compute, GPU, stolen AI API keys and local models, then route AI inference, social engineering and other tasks accordingly. No source code or proof of execution was provided, and most individual techniques are previously documented, so the AI-as-a-service claims remain unverified.
Elastic Security LabsVendor report
Elastic Security Labs found that operators behind REF6045, a Mexican banking-fraud campaign, used an LLM to write most of a PowerShell toolkit called SCMBANKER, based on AI-generated code artifacts in the scripts.
SysdigVendor report
Sysdig's Threat Research Team documented what they assess to be the first fully agentic ransomware operation, dubbed JADEPUFFER, where an LLM autonomously gained access via a Langflow RCE flaw, harvested credentials, exploited Nacos authentication bypasses, and encrypted and destroyed a victim's production database for extortion.
FortiGuard LabsVendor report
FortiGuard Labs documented a multi-stage Windows malware campaign using fake AI-themed documents and guides as lures to deliver AsyncRAT via AutoHotkey-based loaders and process hollowing. Chinese-language code artifacts and structured coding style suggest the attackers used generative AI tools to help build the malware, though this is inferred rather than confirmed.
Breached.companyNews
Researchers at PromptArmor disclosed indirect prompt injection vulnerabilities in four AI productivity tools (IBM Bob, Notion AI, Anthropic's Claude Cowork, and Superhuman AI) between January 7-15, 2026, each exploiting the 'lethal trifecta' of private data access, untrusted content exposure, and exfiltration channels.
AnthropicVendor report
Anthropic analyzed 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping their techniques to MITRE ATT&CK. They found AI use shifting from initial access to post-compromise activity, risk scores rising over time, and the framework failing to capture autonomous agentic orchestration seen in a November 2025 state-sponsored espionage case.
Trend MicroVendor report
Trend Micro identified two campaigns, SHADOW-AETHER-040 and SHADOW-AETHER-064, using agentic AI (including Claude) to drive intrusions from initial access to data exfiltration against government and financial targets in Mexico and Brazil. The AI agents dynamically generated custom tools and backdoors, used jailbreaking via fake red-team pretexts, and integrated with Shodan and VulDB for reconnaissance.
Gambit SecurityVendor report
A single threat actor used Anthropic's Claude Code and OpenAI's GPT-4.1 as core operational tools to breach nine Mexican government organizations and exfiltrate hundreds of millions of citizen records between December 2025 and February 2026.
IBM X-ForceVendor report
IBM X-Force found a likely AI-generated PowerShell C2 backdoor, dubbed Slopoly, deployed by ransomware group Hive0163 during a live intrusion using ClickFix, NodeSnake, InterlockRAT and Interlock ransomware. The malware is technically unremarkable but shows guardrail bypass and signals adoption of AI-assisted malware development among established ransomware actors.
TrendAI ResearchVendor report
TrendAI Research documented a campaign where malicious OpenClaw agent skills trick AI agents like GPT-4o into installing a new variant of Atomic macOS Stealer (AMOS), which then deceives users into entering their password. The malware exfiltrates browser data, crypto wallets, Apple and KeePass keychains, and documents, with hundreds of malicious skills found across ClawHub, SkillsMP, and GitHub repositories.
Hunt.io / cyberandramen.netResearch
A threat actor built a custom MCP server called ARXON that feeds FortiGate reconnaissance data to DeepSeek for attack-plan generation and lets Claude Code autonomously run Impacket, Metasploit and hashcat during live intrusions.
ESET ResearchVendor report
ESET found PromptSpy, Android malware that queries Google's Gemini with UI XML dumps to get step-by-step instructions for locking itself into the recent apps list, aiding persistence. The malware also deploys a VNC module for remote device control and targets users in Argentina; no live samples have been seen in telemetry, suggesting it may still be a proof of concept.
Amazon Threat IntelligenceVendor report
A Russian-speaking financially motivated threat actor used multiple commercial generative AI services to plan attacks, generate exploitation scripts and reconnaissance tooling, and automate credential-based compromise of over 600 internet-exposed FortiGate devices across 55+ countries.
Also covered byTeam Cymru
Moonlock LabVendor report
Moonlock Lab reports that a Google Sponsored ad for a macOS search led users to malware via ClickFix delivery, seen over 15,000 times. One variant abused a public artifact hosted on claude.ai, while another used a Medium post impersonating Apple support, both attributed to the same threat actor.
Unit 42 (Palo Alto Networks)Vendor report
Unit 42 researchers demonstrate proof-of-concept prompt injection attacks against the Model Context Protocol's sampling feature, which lets MCP servers request LLM completions from a client's coding copilot. Using a malicious MCP server disguised as a code summarizer tool, they show resource theft via hidden token-consuming prompts, conversation hijacking, and covert tool invocation without user awareness.
AnthropicVendor report
Anthropic disrupted an influence-as-a-service operation that used Claude to orchestrate over 100 social media personas across X and Facebook, making tactical engagement decisions and generating image prompts for image-generation models.
Also covered byAnthropic
Google DeepMindVendor report
Google DeepMind describes an automated red-teaming framework using optimization-based attacks (Actor Critic, Beam Search, Tree of Attacks with Pruning) to test AI agents' susceptibility to indirect prompt injection that could exfiltrate sensitive user data. This is a defensive research methodology, not a report of real-world exploitation, and no specific incidents are disclosed.
Google Threat Analysis GroupVendor report
Google's TAG reports on DRAGONBRIDGE, a PRC-linked influence operation, disrupting over 10,000 instances in Q1 2024 across YouTube and Blogger, totaling 175,000 lifetime. The actor increasingly used generative AI, including AI-generated news anchors and synthetic voiceovers, to push narratives around Taiwan's election and US social issues, though engagement remained largely inauthentic and low.
OpenAIVendor report
OpenAI describes disrupting five covert influence operations from Russia, China, Iran and an Israeli commercial firm that used its models to generate and refine content, translate text, and fake engagement across social platforms. None of the operations achieved meaningful audience engagement, scoring no higher than Category 2 on the Breakout Scale.
Also covered byOpenAI
AnthropicVendor report
Anthropic describes actors who automate whole intrusion chains with AI agents. One Russian-speaking espionage operator had agents rebuild malware whenever a security product detected it, and used AI to sort hundreds of gigabytes of stolen data.
Also covered byAnthropic
Help Net SecurityNews
Coverage of OWASP's 2026 findings on agentic AI. Most production failures still begin with prompt injection, and attackers increasingly poison what agents trust: MCP servers, packages and coding-tool configuration.
Google Threat Intelligence GroupVendor report
GTIG reports adversaries applying AI to vulnerability exploitation, initial access and faster development of evasive, polymorphic malware. It also covers supply chain attacks against AI components, and notes no actor has yet bypassed the core safety logic of frontier models.
Microsoft SecurityResearch
Microsoft researchers show how a single injected prompt reached host-level code execution in agents built on Semantic Kernel. Model-controlled parameters flowed unsanitized into a search plugin. Both flaws are fixed.
OWASP GenAI Security ProjectResearch
Quarterly review of eight AI-related incidents mapped to the OWASP LLM and agentic risk lists. It includes active exploitation of a maximum-severity Flowise flaw and GrafanaGhost, a prompt injection path that exfiltrates data from Grafana's AI features.
Datadog Security LabsResearch
Two backdoored releases of LiteLLM, a widely used LLM gateway library, were published to PyPI on March 24, 2026 with a credential stealer. Datadog traces the campaign from a poisoned Trivy scanner through npm and into PyPI.
Also covered by
LiteLLMTrend Micro
OpenAIVendor report
OpenAI's case studies show models used as one step in larger workflows that also rely on websites and social accounts: romance and recovery scams, covert influence operations, and a state-linked harassment effort.
Also covered byHelp Net Security
Google Threat Intelligence GroupVendor report
Quarterly view of how actors linked to North Korea, Iran, China and Russia used AI in late 2025. GTIG saw no breakthrough capability, but disrupted frequent model extraction attempts against its own models.
Also covered byGoogle
AnthropicVendor report
A group tasked Claude Code with running intrusions against roughly 30 organisations, with the model carrying out an estimated 80 to 90 percent of tactical work. Anthropic validated a handful of successful compromises before banning the accounts.
Also covered byAnthropic
Google Threat Intelligence GroupVendor report
GTIG documents the first malware families that query an LLM during execution to generate scripts and rewrite their own code. It also describes actors posing as students or researchers to talk Gemini past its safeguards.
Infosecurity MagazineNews
Researchers reported that extensions for the Claude desktop app could be driven by instructions planted in web content, turning an ordinary browsing request into a path to actions on the user's machine.
OpenAIVendor report
Koi SecurityResearch
An npm package posing as the Postmark MCP server behaved normally for fifteen versions, then added one line that copied every email sent through it to the author's server. Koi calls it the first malicious MCP server seen in the wild.
Also covered by
The Hacker News
Dark ReadingSnyk
SentinelLABS hunted for binaries carrying LLM API keys and embedded prompts, and found MalTerminal, which asks GPT-4 to write ransomware or a reverse shell at runtime. A retired API endpoint dates it before November 2023. No live use is known.
AnthropicVendor report
Introduces vibe hacking: one criminal used Claude Code to run data extortion against at least 17 organisations. Other cases cover North Korean remote worker fraud, ransomware sold by a developer with little coding skill, and AI across the fraud ecosystem.
Also covered byAnthropic
ESET ResearchResearch
PromptLock runs OpenAI's gpt-oss-20b locally through Ollama to generate Lua scripts that enumerate, exfiltrate and encrypt files. ESET later confirmed the samples match an academic prototype, not malware deployed in attacks.
The Hacker NewsNews
An indirect prompt injection could make Cursor's agent write a malicious MCP configuration file without user approval, giving the attacker remote code execution on the developer's machine.
guardsixVendor report
LameHug is Python malware attributed to APT28/UAC-0001 that queries the Qwen 2.5-Coder-32B-Instruct model via the Hugging Face API to dynamically generate Windows recon and data-theft commands from natural language prompts.
Also covered byThe Hacker News
SecurityWeekNews
Aim Security showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no user interaction. Microsoft patched it server-side and reported no exploitation in the wild.
Also covered byarXiv
Google Threat Intelligence GroupVendor report
GTIG's first analysis of how government-backed groups used Gemini. Actors from Iran, China, North Korea and Russia used it for research, coding help and content, and did not develop novel capabilities with it.
Also covered by
TechTarget
Wiz ResearchResearch
An unauthenticated ClickHouse database belonging to DeepSeek exposed over a million log lines, including chat history, API secrets and backend details, and allowed full control of the database. DeepSeek secured it after disclosure.
Microsoft Threat IntelligenceVendor report
Microsoft and OpenAI published the first joint account of state-affiliated groups using LLMs, mostly for reconnaissance, scripting help and social engineering content. The accounts were disabled.
Also covered byOpenAI
Try an actor name, a malware family, a CVE identifier or a source. Search covers titles, summaries and tags.
Flare
CNN
Knostic
The CyberWire
Hunt.io
IT Brew
Dataconomy
