Agentic workflows have now proven their worth among cybercriminals as well. A hacker collective monitored by the Google Threat Intelligence Group was able to harvest login credentials in just six hours. AI models and configurations for these large language models (LLMs) are now key targets alongside credentials and API keys.
The latest report from the Google Threat Intelligence Group (GTIG) describes how attackers are using AI for sophisticated purposes. They deploy multi-agent frameworks that orchestrate scans from start to finish, resolve errors autonomously, and collect credentials at scale. As a result, the time defenders have to respond is significantly reduced.
In one case, a financially motivated actor compromised a victim’s cloud infrastructure and deployed an autonomous attack framework there. Using an AI chatbot and preconfigured Markdown playbooks (AGENTS.md, KNOWLEDGE.md), a campaign was launched in less than six hours that stole thousands of third-party credentials, including real-time IP rotation.
Prompt injection against AI scanners
Noteworthy is the approach taken by UNC6780, also known as TeamPCP. Since March 2026, the group has been compromising packages on PyPI, npm, and Docker Hub. The DUSTMAKER stealer hides files in directories such as .claude/, .vscode/, and .cursor/, where AI assistants and IDEs automatically load them. Through config files, the assistant is instructed to execute scripts without the developer noticing.
The malware also includes prompts at the top of JavaScript loaders that refer to extreme security breaches. The goal is to cause LLM scanners to refuse to analyze the underlying code. Additionally, DUSTMAKER steals OIDC tokens from GitHub Actions to publish packages with valid SLSA Build 3 attestations.
AI models as loot
GTIG also reports the theft of organizations’ proprietary AI models, in addition to prompts and research in critical sectors such as healthcare, pharma, media, and government. The PRC-affiliated group UNC6508 runs open-weight models on compromised infrastructure to evade commercial API monitoring. Extraction campaigns targeting Google’s models sometimes exceed 100 million prompts.
The trade in AI accounts is growing alongside this trend. Average market prices per account doubled in 2026. Techzine previously reported on the first large-scale LLMjacking campaign, in which access is resold at 40 to 60 percent below retail price. According to Sysdig, the costs for victims can exceed $100,000 per day.
Google says it has disabled the affected accounts, and DeepMind is using the insights to refine its classifiers. The company had previously reported a general increase in AI abuse by cybercriminals.