Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Summary

Google Threat Intelligence Group (GTIG) reports a marked evolution in adversarial use of AI, in which threat actors have moved from simply prompting chatbots to fielding autonomous, agentic frameworks. In the most striking case, a financially motivated actor compromised an unnamed organization's cloud infrastructure and deployed a multi-agent framework that planned, built, and executed a mass credential-harvesting campaign in under six hours, compromising thousands of third-party credentials.^[0]

The activity spans financially motivated crime and nation-state espionage. TeamPCP (aka Altered Spider, UNC6780) has run large-scale software supply chain compromises across PyPI, npm, and Docker Hub, deploying the SANDCLOCK and DUSTMAKER credential stealers, while China-, Russia-, Iran-, and North Korea-nexus groups have used commercial and open-weight LLMs to accelerate reconnaissance, exploit development, phishing, and operational automation.^[0]

GTIG assesses that agentic AI creates a scaled, faster adversary and that open-weight and 'abliterated' uncensored models raise risk by enabling local, unmonitored deployments lacking safety guardrails, with actors hosting local models on compromised hosts to evade provider monitoring.^[0]

Attack chain

1. Initial compromise (six-hour campaign): A financially motivated actor compromised an unnamed organization's cloud infrastructure to stage its operation.^[0]
2. Tooling deployment: The actor deployed an autonomous, multi-agent attack framework, using an AI coding chatbot, a prompt, and a set of agent instructions to plan and build the campaign.^[0]
3. Automated execution: Using preconfigured markdown instruction sets as operational playbooks, the framework autonomously managed the vulnerability scanning pipeline, conducted real-time troubleshooting, and executed IP rotation logic without human handholding.^[0]
4. Credential harvesting: Automated scanning and credential harvesting compromised thousands of third-party credentials within six hours.^[0]
5. Supply chain compromise (TeamPCP): Separately, TeamPCP compromised PyPI, npm, and Docker Hub packages, then deployed the SANDCLOCK and DUSTMAKER credential stealers to obtain cloud, developer, and AI-assistant credentials, monetizing them via direct sale or partnerships with ransomware and extortion groups.^[0]

Disclosure timeline

Actor profile

TeamPCP (Altered Spider, UNC6780)

A financially motivated threat actor conducting a series of large-scale software supply chain compromises against PyPI, npm, and Docker Hub. It deploys credential stealers SANDCLOCK and its successor DUSTMAKER to harvest cloud, developer, cryptocurrency, and AI-coding-assistant credentials, monetizing them through direct sale or partnerships with ransomware and data-theft extortion groups. DUSTMAKER uniquely incorporates AI-targeting techniques such as poisoning AI assistant workspaces and prompt injection for defense evasion.^[0]

How it works

The autonomous credential-harvesting operation relied on AI agents to drive the attack pipeline: an AI coding chatbot plus a prompt and agent-instruction set (delivered as markdown playbooks) enabled the system to autonomously manage vulnerability scanning, troubleshoot in real time, and rotate IP addresses without human intervention.^[0]

DUSTMAKER's AI-targeting techniques include poisoning AI assistant workspaces and using prompt injection to evade defenses, techniques absent from the earlier SANDCLOCK stealer.^[0]

UNC6508 deploys local, open-weight LLM infrastructure on compromised cloud environments so that inference is not visible to commercial frontier model providers, defeating provider-side misuse monitoring.^[0]

Indicators of Compromise

Key takeaways

• Adversaries have progressed from prompting LLMs to deploying autonomous multi-agent frameworks capable of executing end-to-end attacks, such as a credential-harvesting campaign completed in under six hours.^[0]
• AI misuse now spans financially motivated crime (TeamPCP supply chain compromises, info-stealers targeting AI configs) and nation-state espionage (China-, Russia-, Iran-, and North Korea-nexus groups using Gemini, Claude, and Codex).^[0]
• Open-weight and uncensored models materially raise risk by enabling local, unmonitored deployments, prompting calls for enforceable industry-wide AI safety baselines.^[0]

Defensive actions

• Protect and monitor developer, cloud, and AI-assistant credentials, and secure CI/CD pipelines against supply chain compromise.: TeamPCP's SANDCLOCK/DUSTMAKER stealers and expanded info-stealers specifically target cloud, developer, and AI developer credentials via PyPI, npm, and Docker Hub compromises and CI/CD pipelines.^[0]
• Govern open-weight and uncensored ('abliterated') model deployment and restrict uncensored checkpoints through coordinated platform policies and enforceable industry-wide safety baselines.: GTIG assesses open-weight models enable local, unmonitored deployments lacking safety guardrails, giving adversaries advantages for phishing and malicious scripting; actors host local models on compromised hosts to evade provider monitoring.^[0]
• Use contained enterprise AI environments (e.g., Gemini Enterprise) to leverage open-source models securely.: GTIG recommends contained, safe environments to reduce risk from unmonitored open-model use while preserving innovation.^[0]
• Prioritize rapid detection and response given agentic, high-velocity attacks.: GTIG warns that agentic AI creates a scaled, faster adversary, exemplified by a mass credential campaign executed in under six hours—faster than defenders can typically respond.^[0]