Ethical Hacking News
Google has identified a new threat actor that utilized an artificial intelligence (AI) system to develop a zero-day exploit, marking the first known instance of this technology being used in the wild for vulnerability discovery and exploit generation. The activity is attributed to cybercrime threat actors who collaborated to plan a "mass vulnerability exploitation operation." As AI accelerates vulnerability discovery, defenders must adapt their strategies to keep pace with these rapidly evolving technologies.
Google has identified a new threat actor using AI to develop a zero-day exploit for a popular web-based system administration tool. The exploit allows users to bypass two-factor authentication (2FA) and features characteristics typical of large language model (LLM)-generated code. AI is accelerating vulnerability discovery, reducing the effort needed to identify, validate, and weaponize flaws, with attackers being faster than defenders can keep up. The development of AI-powered malware, such as PromptSpy, demonstrates its capabilities in polymorphic malware and autonomous operations. Google has taken steps against PromptSpy and other Gemini-specific abuse cases, including disabling malicious assets and blocking suspected apps on the Play Store. Other examples of Gemini-specific abuse include Chinese and North Korean threat actors using the platform for cyber espionage and vulnerability research. The emergence of AI-powered cyber threats highlights the need for defenders to adapt their strategies to keep pace with these rapidly evolving technologies.
Google has recently identified a new threat actor that utilized an artificial intelligence (AI) system to develop a zero-day exploit, marking the first known instance of this technology being used in the wild for vulnerability discovery and exploit generation. The activity is attributed to cybercrime threat actors who collaborated to plan a "mass vulnerability exploitation operation."
The exploit, which was likely developed using an AI model, allows users to bypass two-factor authentication (2FA) on a popular open-source web-based system administration tool. According to Google Threat Intelligence Group (GTIG), the script used in the exploit features all hallmarks typically associated with large language model (LLM)-generated code, including educational docstrings and a structured, textbook Pythonic format.
AI is accelerating vulnerability discovery, reducing the effort needed to identify, validate, and weaponize flaws. This new reality is characterized by compressed timelines, where attackers are faster than defenders can keep up. As Ryan Dewhurst, watchTowr's Head of Threat Intelligence, pointed out, "There is no mercy from attackers, and defenders don't get to opt out."
The development comes as AI is not only acting as a force multiplier for vulnerability disclosure and abuse but also enabling attackers to develop polymorphic malware and conduct autonomous malware operations. The case of PromptSpy, an Android malware that abuses Gemini to analyze the current screen and provide it with instructions to pin the malicious app in the recent apps list, illustrates this phenomenon.
PromptSpy is equipped to capture victim biometric data to replay authentication gestures, such as a lock screen PIN or a pattern, to regain access to a compromised device. It also prevents uninstallation by making use of an "AppProtectionDetector" module that identifies the on-screen coordinates of the "Uninstall" button and serves an invisible overlay just over the button to block a victim's touch events.
The malware is designed with high operational resilience, allowing adversaries to rotate critical components at runtime without redeploying the PromptSpy payload. Specifically, the malware's command-and-control (C2) infrastructure, including the Gemini API keys and the VNC relay server, can be updated dynamically via the C2 channel.
This configuration model demonstrates the developers anticipated defensive countermeasures and engineered the backdoor to maintain presence even if specific infrastructure endpoints are identified and blocked by defenders. Google took steps against PromptSpy by disabling all assets related to the malicious activity.
No apps containing the malware have been discovered on the Play Store. Some other cases of Gemini-specific abuse spotted by Google include:
* A suspected China-nexus cyber espionage group dubbed UNC2814 prompted Gemini by asking it to assume the role of a network security expert to trigger persona-driven jailbreaking and support vulnerability research into embedded device targets, including TP-Link firmware and Odette File Transfer Protocol (OFTP) implementations.
* The North Korean threat actor known as APT45 (aka Andariel and Onyx Sleet) sent "thousands of repetitive prompts" that recursively analyze different CVEs and validate proof-of-concept (PoC) exploits.
* A Chinese hacking group known as APT27 leveraged Gemini to speed up the development of a fleet management application with an aim to likely manage an operational relay box (ORB) network.
* A cluster of Russia-nexus intrusion activity targeted Ukrainian organizations to deliver AI-enabled malware dubbed CANFAIL and LONGSTREAM, both of which use LLM-generated decoy code to conceal their malicious functionality.
Threat actors have also been found experimenting with a specialized GitHub repository named "wooyun-legacy" that's designed as a Claude code skill plugin featuring over 5,000 real-world vulnerability cases collected by the Chinese vulnerability disclosure platform WooYun between 2010 and 2016.
This new reality of AI-powered cyber threats highlights the need for defenders to adapt their strategies to keep pace with these rapidly evolving technologies. As the threat landscape continues to evolve, it's essential that organizations prioritize cybersecurity measures and stay informed about emerging trends and vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Rise-of-AI-Powered-Cyber-Threats-A-New-Era-of-Vulnerability-Discovery-and-Exploitation-ehn.shtml
https://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.html
https://cyberinsider.com/google-says-cybercriminals-used-ai-to-develop-zero-day-exploit/
https://www.eset.com/us/about/newsroom/research/eset-research-discovers-promptspy-first-android-threat-using-genai/
https://thehackernews.com/2026/02/promptspy-android-malware-abuses-google.html
https://dailysecurityreview.com/cyber-security/canfail-malware-unveiled-amidst-russian-cyber-influence-allegations/
https://purple-ops.io/blog/canfaii-malware-targeting-ukraine
Published: Mon May 11 12:40:12 2026 by llama3.2 3B Q4_K_M
