TLDR Tech / InfoSec
Russian Hacker Used Jailbroken Gemini to Steal Admin Credentials and Drain Crypto Wallets
TrendAI Research has exposed a solo Russian-speaking actor tracked as "bandcampro" who ran a five-year MAGA-themed influence operation by persistently jailbreaking Google Gemini CLI, planting escalating instructions in a GEMINI.md memory file that the CLI reloads every session, and reinforcing the bypass with Russian-language prompts that evade inconsistently enforced non-English guardrails. With safety controls disabled, Gemini powered a "Quantum Patriot" content pipeline generating QAnon posts, produced up to 20 password mutations per target that cracked 29 WordPress admin accounts when combined with DaisyCloud infostealer logs, and supported a trojanized StellarMonster wallet installer (actually the GoToResolve RAT) that harvested seed phrases and drained at least one victim's crypto, all funded by 73 round-robin-rotated stolen API keys with C2 nodes at 213.165.51[.]115, 34.34.57[.]141, 34.34.81[.]129, and 35.192.41[.]201. Defenders should monitor for stolen API key reuse, anomalous CLI-driven infrastructure changes, and credential-stuffing patterns consistent with LLM-assisted password mutation.
Read the full story