AI agents enable rapid credential theft and data extortion in cyberattacks
Google's Threat Intelligence Group reported that threat actors have integrated AI agents into cyberattacks to rapidly steal credentials and conduct data extortion at scale. A China-linked group used AI agents to steal thousands of credentials in six hours, while attackers increasingly target AI intellectual property and computing resources for leverage or expansion of attack capabilities.
What happened
Google's Threat Intelligence Group released its Q3 2026 AI Threat Tracker report warning that threat actors have deeply integrated AI into cyberattacks throughout the intrusion lifecycle, from initial target intelligence gathering to post-breach troubleshooting.
BASIN CASTLE, a China-linked cyber espionage group, is using large language models to assist with target research and error handling during intrusions. Another China-linked group attempted to use Gemini to build an automated penetration testing framework with AI agents executing initial intrusion phases.
Mandiant observed a large-scale credential theft operation where attackers deployed multi-agent AI frameworks on compromised infrastructure, with multiple AI agents autonomously executing attacks and stealing thousands of credentials in six hours.
Reported impact
High-value AI intellectual property from technology, healthcare, and media entertainment companies in North America and Europe has become a target, with threat actors using stolen data as leverage for extortion demands.
Threat actors are targeting cloud environments, GPU computing resources, and LLM APIs to obtain AI resources. UNC6508, a China-linked group previously targeting US healthcare institutions, is hosting models on compromised cloud environments, causing victims to pay for unauthorized AI workloads.
Index analysis
Google's chief analyst John Hultquist stated that virtually all types of threat actors have now deployed AI operationally. The critical challenge is agentic AI, which represents a shift from AI assisting hackers to AI autonomously executing attacks with greater speed, scale, and minimal human involvement.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.