Google Says AI Agents Now Compress Thefts Into Hours

On September 8, Google Threat Intelligence Group said attackers used an AI coding chatbot to steal thousands of credentials in less than six hours. The same report warned that UNC6780, the crew also called TeamPCP, had published its supply-chain malware, and that other operators would copy the method.

Mandiant watched a suspected cash-driven actor break into a company’s cloud first, then hand the rest of the job to agents. Those agents scanned, fixed their own errors, and rotated addresses while the traffic left through the victim’s own internet path.

A Coding Chatbot Built a Harvest in Six Hours

GTIG’s September 8 tracker, titled From Prompting to Autonomy, says crews have moved past one-off chatbot questions. They now wire models into multi-agent jobs that keep running when a human steps away. In the second quarter of 2026, that shift showed up as a full harvesting campaign in less than six hours.

The threat actor leveraged an AI coding chatbot, a prompt, and a set of agent instructions to plan, build, and execute a mass credential harvesting campaign in less than six hours.

Google Threat Intelligence Group, GTIG AI Threat Tracker, September 8, 2026

Prewritten markdown files acted as playbooks, so the operator could point the same stack at a new target without rewriting the logic. The agents ran the scan pipeline, repaired failures as they appeared, and handled address rotation with no one at the keyboard. Because the work sat on stolen cloud hosts, outbound requests carried legitimate addresses, and filters that watch for odd origins saw a tenant they already trusted.

GTIG separately found an exposed command server for a kit it calls Recon. Directory listings showed agent files named AGENTS.md and KNOWLEDGE.md. The folder then became a live dashboard meant to sort, check, and manage over 23,800 stolen secrets, including cloud and AI-service API keys.

THE Q2 2026 CLOCK

• Build time: Plan, build, and run the harvest in less than six hours after the cloud break-in.
• Take: Thousands of third-party logins from the agent-run scan.
• Recon stash: Over 23,800 secrets on the exposed C2 dashboard, including cloud and AI keys.
• Still missing: GTIG says it has not yet seen a fully self-running zero-day pipeline used on a live target.

Speed is the change that matters for a night-shift defender. Old noisy scans burned days on mistakes. This stack treats troubleshooting as just another agent task, so the window to notice the first odd login shrinks to a single business afternoon.

The Worm They Published Outlived the Crew

UNC6780 is the example GTIG uses for what happens when that speed meets public package registries. Since March 2026 the crew has hit PyPI, npm, and Docker Hub, then dropped stealers and sold access, sometimes with ransomware and extortion partners. GTIG’s line on the next stage is blunt.

The publicity, apparent success, and open-source release of UNC6780’s malware will likely spur adversary emulation of these tactics.

Google Threat Intelligence Group, September 8, 2026

That warning is already late. On May 12, 2026, TeamPCP put Mini Shai-Hulud on GitHub. On June 1 a separate operator hit 32 packages in Red Hat’s @redhat-cloud-services npm scope with a payload branded Miasma. On June 8 those operators published their own TypeScript, with a note that they were “giving back too” in the spirit of TeamPCP’s release.

FROM TRIVY TO COPYCATS

1. March 19, 2026: TeamPCP rewrites Trivy GitHub Action tags so CI jobs pull a stealer later labeled SANDCLOCK.
2. March 24, 2026: Stolen publish rights reach LiteLLM on PyPI, an AI gateway that sits in front of many model APIs.
3. May 11, 2026: Mini Shai-Hulud hits TanStack and then spreads across npm and PyPI namespaces.
4. May 12, 2026: The crew publishes the worm source, lowering the cost of a copy.
5. May 18, 2026: A poisoned Nx Console build reaches a GitHub employee laptop; about 3,800 internal GitHub repositories are later listed for sale.
6. June 1, 2026: Miasma lands in 32 Red Hat npm packages using a trusted-publishing gap on throwaway branches.
7. June 5, 2026: GitHub disables 73 Microsoft repositories in 105 seconds after a backdated commit plants assistant config files.

Each hop fed the next with stolen publish tokens, so a scanner breach became a registry breach, then a worm. The June wave also used Python.pth startup hooks and native extensions, which means “ignore install scripts” on npm does not cover the Python side.

Dustmaker Hides Inside the Assistant Folders

GTIG says UNC6780 used more than half a dozen tricks against AI tools and open-source build habits, several of them inside a stealer called Dustmaker. The payload does not only grab cloud keys. It treats coding assistants as the install path.

One method publishes trojaned forks of Model Context Protocol servers, including tiktoken_mcp on PyPI, and injects code into GitHub repos such as azure-functions-mcp-extension. When a developer or an agent clones the project, the hook arrives with the workspace. Another method watches for CI, pulls OIDC tokens out of GitHub Actions runner memory, and publishes poisoned packages with valid SLSA Build 3 attestations. Those packages then pass the automated trust checks that agents run before they install a dependency.

HOW DUSTMAKER USES THE ASSISTANT

• Hidden dirs: It drops files into.claude,.vscode, and.cursor folders that assistants already parse, which looks like ordinary project clutter to endpoint tools.
• Startup hooks: Those files set build or open commands so the payload runs when the IDE or the AI extension opens the folder.
• Prompt push: Config text tells the assistant to run attacker scripts during normal chat, so the model executes the next step for the operator.
• Fake CI jobs: In GitHub Actions it creates tasks with AI-themed names such as Copilot Setup, then deletes the workflow logs through the API.
• Scanner bait: Comments at the top of JavaScript loaders rant about biological and nuclear weapons so LLM security scanners hit a safety refusal and skip the code underneath.

That last trick turns a defense product into a blind spot. The scanner is working as designed when it refuses the prompt. The malware counts on that refusal. Google says Gemini’s safety filters caught related abuse, and DeepMind tightened classifiers so the model will refuse more of these jobs. It also posted guidance for open source supply chain compromises covering token hygiene, provenance checks, and package review.

Cloning a repo can look clean in a browser. Opening the same folder in Claude Code, Gemini CLI, Cursor, or VS Code is the moment the hidden files fire.

Perth Arrests Do Not Retract the Source Code

Australian Federal Police, working with Western Australia Police and the FBI, arrested two Western Australian men on August 26, 2026. Police say TeamPCP’s code may have reached more than 1,000 organizations, with more than 500,000 credentials stolen and more than 300 gigabytes of data shipped out. The two men face a combined 14 Australian offences. They have not been convicted.

A federal grand jury in San Francisco had already voted an indictment on August 25. The U.S. Attorney’s Office for the Northern District of California indicted for TeamPCP supply chain attacks Ruben Ian Thomson, 21, a national of Australia and South Africa, on conspiracy to violate the Computer Fraud and Abuse Act and on obtaining information from a protected computer. U.S. Attorney Craig H. Missakian and FBI San Francisco Special Agent-in-Charge Scott Schelble announced the case. An indictment is an allegation. If convicted on the U.S. counts, Thomson faces up to 5 years in prison and a $250,000 fine, or twice the gain or loss, on each count.

The charging papers describe a cascade: break trusted security tools, poison what those tools ship, steal from whoever runs them, keep a foothold, then demand ransom for silence. That matches the Trivy-to-registry pattern vendors logged in March. It does not pull Mini Shai-Hulud or Miasma off GitHub, and it does not expire a token already sitting in a copycat’s loot pile.

China, Iran, and North Korea Query the Same Models

Cash crews are not the only users. GTIG maps Gemini misuse across state groups that still keep a human in the loop, but now farm out the grunt work of translation, lure writing, and script debug.

HOW STATE CREWS USED GEMINI

UNC6508, another China-nexus cluster, spent years on academic, medical, and military labs in North America and has been seen standing up local open-weight models inside stolen cloud accounts. That move dodges commercial API logs and bills the victim for the compute. A separate China-nexus group used a switcher tool to bounce among Claude, Gemini, and Codex while it tried to assemble an exploit pipeline, including a planned drop of an open-source autonomous penetration testing tool called Phalanx. GTIG says that build stayed at the attempt stage and that Google disabled the related accounts.

DPRK-linked IT-worker clusters have also been seen registering LLM APIs in bulk on hijacked accounts. North Korean crypto-theft crews used coding assistants such as DeepSeek-Coder to write cross-platform RATs, then altered Claude CLI hooks so a developer’s next session loaded a backdoor GTIG calls Sombermeme.

Distillation Crews Siphon Frontier Model Output

On the same date as the GTIG tracker, CISA, NSA, and the FBI published advisory AA26-251A on industrial-scale knowledge distillation campaigns by China-based AI firms. The agencies name DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and they say the work has run since at least late 2024 against Claude, GPT, Gemini, and Grok variants, pulling billions of tokens across millions of requests, likely with Chinese government awareness.

DeepSeek’s public $5.6 million training figure, the advisory says, leaves out the cost of data taken this way. Operators route queries through native APIs, cloud resellers, and a gray market of “transfer stations” that hide user metadata and dodge regional blocks. They buy premium seats in bulk and fail over when a path is cut. CISA Acting Director Nick Andersen urged U.S. AI firms to lock down accounts, watch usage spikes on new seats, and share signals across providers.

Google’s own notes match the scale. Since a February 2026 paper, it has seen coordinated Gemini extraction jobs on a regular cadence, some exceeding 100 million prompts, aimed at vision, audio, image, and video skills. Attackers rotate thousands of stolen and fake accounts. Google says it now degrades unauthorized student models in real time, traces Gemini-derived weights, and treats the activity as a terms-of-service breach that can bring takedowns and lawsuits.

Mandiant also handled Q2 extortion cases in which stolen goods were the models themselves: weights, prompts, skills, and research from health, media, and tech firms in North America and Europe. One health-sector victim lost drug research and an in-house model. A media-generation firm lost source, prompts, and secrets, then faced a leak threat.

Disabled Accounts Leave the Malware on Registries

Google’s counter is account-level. When it spots abuse it kills the projects, hardens Gemini, and feeds the cases into DeepMind classifiers. In June 2026 it disrupted a China-based phishing kit shop called Outsider Enterprise that used Gemini to write code, and it said that case was its first legal action over Gemini misuse. A product stack branded Google AI Threat Defense ties Gemini, Wiz, CodeMender, and Mandiant into automated cleanup for paying customers.

Those moves shrink the official API path. They do not unsay a markdown playbook, unpublish Mini Shai-Hulud, or make a stolen OIDC token forget how to mint a signed package. Copycat operators already proved they can read the source and swap the mythology in the strings. Miasma kept the Bun loader, the SLSA minting, the dead-drop C2, and a dead-man switch, then thanked TeamPCP in the README.

GTIG still has not logged a fully self-running zero-day factory against a live target. It has logged a cash-driven crew that planned, built, and ran a mass harvest in less than six hours from inside someone else’s cloud, and a published worm that other people compiled. The accounts can go dark. The files stay up.