Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
Summary: Google Threat Intelligence Group reported that a financially motivated threat actor compromised an unnamed organization's cloud infrastructure and used an AI coding chatbot, a prompt, and preconfigured markdown instruction sets to run an autonomous, multi-agent credential harvesting campaign in under six hours, compromising thousands of third-party credentials. GTIG also tied a series of large-scale supply chain compromises on PyPI, npm, and Docker Hub to a group called TeamPCP, which deploys the credential stealers SANDCLOCK and DUSTMAKER, the latter a cross-platform JavaScript payload for CI/CD pipelines that adds AI assistant workspace poisoning and prompt injection for defense evasion.
Bottom line: A campaign that harvested thousands of credentials in under six hours ran its own scanning pipeline, troubleshooting, and IP rotation without a human, which sets the response clock against an adversary operating at machine speed. GTIG's John Hultquist put the stake plainly: criminals will gravitate to attacks that are faster than we can respond to.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026