Loading story…
Cisco Talos reported that threat actors are increasingly using cloud AI tools such as Claude Code, CodeX, Cursor, and Gemini to support malicious operations, after analyzing prompt artifacts recovered from compromised endpoints. The research found three dominant use cases: AI as a malware and software engineering assistant, AI as a criminal force multiplier, and AI as an accelerator for vulnerability research and penetration-testing-style activity. Talos said existing model guardrails were often ineffective, with actors bypassing them through false ownership claims, bug-bounty or CTF pretexts, task decomposition across sessions, persistent persona conditioning, semantic evasion, or by moving to uncensored models.
Case studies showed AI being used to help build DDoS tooling targeting Android TV devices, bulk email validation and phishing-adjacent infrastructure based on PowerMTA and Node.js, credential-harvesting workflows including abuse of exposed .git/config files and React2Shell techniques, and cryptojacking campaigns that used weak Deluge and qBittorrent credentials to deploy XMRig. Talos also documented AI-enabled scam and cryptocurrency theft activity, including a russophone scam chatbot, a hispanophone actor using an autonomous OpenClaw-based agent called Alex to target Telegram Mini Apps and TON wallets, and autonomous offensive frameworks such as Hephaestus; the firm warned that AI is lowering barriers for novice attackers while enabling more capable operators to scale intrusion, fraud, and exploitation pipelines faster.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos published a data-driven analysis of how threat actors are weaponizing AI, based on prompt logs and endpoint artifacts from tools including Claude Code, CodeX, Cursor, and Gemini. The report identified major patterns including malicious software engineering, criminal force multiplication, and vulnerability research acceleration.
OASIS Security disclosed the Hephaestus automated attack framework, describing Claude AI-powered attacks targeting government and educational institutions in Indonesia. The reference indicates a distinct campaign or operational framework separate from the Tubely/Astute Software activity and Talos's broader AI weaponization research.
Talos linked tubely[.]com to a documented history of non-consensual contact harvesting and tied the later 2026 operation to the same operator identity, Astute Software. The historical activity is explicitly dated to 2009 to 2011 in the source.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcetheregister.com
Open sourceinfosecurity-magazine.com
Open sourceblog.talosintelligence.com
Open sourcecyberveille.ch
Open sourceoasis-security.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026
Underground operators are increasingly packaging generative AI into **criminal AI-as-a-service** offerings that support phishing, fraud, impersonation, malware modification, translation, and post-breach data analysis. Reporting on the market describes branded tools such as **FraudGPT**, **GhostGPT**, and **WormGPT**, but says many are little more than wrappers around legitimate models, stolen accounts, or hijacked API keys rather than fully autonomous hacking platforms. Researchers also highlighted a parallel market for deepfake-enabled abuse, including voice cloning, face swaps, fake selfies, and virtual camera injection used for KYC bypass, synthetic identity fraud, and onboarding scams. Sophos separately identified a malware development lab using AI tools including **Cursor** and **Claude Opus** to speed ransomware-related coding, payload refinement, and evasion testing. The framework reportedly generated Python-driven Rust and Go malware modules, customized **Cobalt Strike** profiles, Telegram-based command channels, Cloudflare Worker intermediaries for command-and-control traffic, code-injection scripts targeting legitimate Windows applications, and AI-assisted Active Directory reconnaissance. Researchers said the operation tested nearly 80 modules against more than 70 evasion methods across Sophos, CrowdStrike, and Microsoft defenses, reinforcing that the immediate risk is not autonomous AI malware but faster, cheaper, and more scalable attacker workflows.
Jun 29, 2026
Check Point Research reported that AI use in offensive cyber operations advanced from planning support to direct execution during March and April, with commercial tools such as **Claude Code** appearing in live criminal, ransomware, mass-exploitation, and state-linked espionage activity. The report cites persistent AI-assisted operations tied to the breach of nine Mexican government agencies and the **Bissa Scanner** mass-exploitation platform, and says attackers are increasingly using AI to accelerate reconnaissance, exploitation, and post-compromise actions in ways that closely resemble skilled human operators. The report also identifies new attack surfaces and scaling effects created by enterprise AI adoption. Agentic configuration artifacts including `CLAUDE.md`, hooks, settings files, and MCP-related files were described as targets for jailbreaks, supply-chain compromise, and credential theft, while the **EvilTokens** platform was highlighted for using LLMs to automate token theft, email analysis, business email compromise, and multilingual fraud. Check Point said AI is shrinking the patch window for defenders by speeding flaw discovery and weaponization, pointing to exploitation of an **LMDeploy SSRF** issue within 12 hours of disclosure, while warning that existing victim-side controls remain poorly suited to detecting AI-executed intrusions.
Jun 29, 2026