TLDR Tech / InfoSec
GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access
The Google Threat Intelligence Group reported the first observed criminal use of an AI-developed zero-day, a 2FA-bypass exploit against an open-source sysadmin tool that GTIG disrupted before deployment. They also detailed PRC actors chaining persona jailbreaks with the "wooyun-legacy" Claude skill plugin and 85,000 historical bug cases to scale CVE analysis, along with Russia-nexus malware padding payloads with LLM-generated decoy logic to evade static signatures. The report highlights threats like PROMPTSPY, an Android backdoor that interprets on-screen UI and autonomously issues actions, and TeamPCP pivoting from supply-chain compromises to AI gateways using the SANDCLOCK stealer, with defenders advised to focus on AI tooling stacks, supply-chain assets, and detecting semantic logic flaws that static analysis tools may miss.
Read the full story