other

Recon (attacker framework)

Automated reconnaissance and credential management framework found on attacker infrastructure, built around agent instruction and knowledge files plus a secrets dashboard.

Current clusters

security1 publisher

Dustmaker lifts GitHub Actions tokens so its packages clear AI coding trust checks

Google Threat Intelligence Group's September 8 report puts a financially motivated actor, UNC6780, inside PyPI, npm and Docker Hub, publishing under stolen maintainer automation and reselling the AI tool credentials it collects afterwards.

Publishers:infosecurity-magazine.com

Reality

Evidence54
Adoption45
Hype gap+22
Incentives64
Confidence56

security3 publishers

Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours

Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.

Publishers:bleepingcomputer.comhelpnetsecurity.comthehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 30%
Operator: Operator 57%
Investor: Investor 13%

Reality

Evidence58
Adoption62
Hype gap+24
Incentives70
Confidence66