Google Threat Intelligence Group (GTIG) documented a case in which attackers used autonomous AI agents to plan, build and execute a massive credential theft campaign in less than six hours, compromising thousands of third-party accounts. The attacker, allegedly for financial motivation, first they compromised the cloud infrastructure of an organization and then deployed a multi-agent framework that automated the entire attack process.
The AI agents autonomously managed vulnerability scanning, credential collection, real-time error resolution, and IP address rotation, all with minimal human intervention. The system used an AI coding chatbot, preconfigured prompts and operational instructions stored in Markdown files that served as guides for the autonomous framework.
In addition, GTIG identified an exposed command and control server with a platform called Recon, whose dashboard organized and validated more than 23.800 stolen secrets in real time, including API keys for cloud and AI services. This case illustrates the shift toward “offensive AI”, where processes that previously took days or weeks of manual work are now completed in hours, dramatically accelerating the lifecycle of cyberattacks.
Fountain: Infobae