Google clocks TeamPCP standing up a mass credential-harvesting campaign in under six hours

The listed inputs are an AI coding chatbot, one prompt and a set of agent instructions, and the six hours covers planning, building and execution ^[2]. GTIG's framing of what that buys is scale normally associated with larger, better-resourced groups, including state-affiliated ones ^[17].

The route into victims is older than the tooling. Since March 2026 the same actor has run compromises against PyPI, npm and Docker Hub ^[3], and GTIG counts more than half a dozen distinct methods it has implemented to target or exploit AI tools and open source development practices, some of them built into its Dustmaker credential stealer ^[4].

Then the crew published. Shai-Hulud and Miasma are both publicly available ^[5], and GTIG expects the publicity, apparent success and open-source release to spur emulation ^[6]. For anyone triaging a registry compromise, that changes what the code tells you: seeing Shai-Hulud or Miasma in an incident says only that the tooling is public, not that UNC6780 built it or ran it ^[18].

The state-linked half of the report reads differently. Six state-nexus operations are named or described, four of them PRC-nexus ^[19]. Basin Castle queries LLMs to profile high-value targets, draft and translate lures, author obfuscated malware and troubleshoot post-exploitation commands ^[11]. Calanque Ion, the Iran-backed group also tracked as APT42, uses gen-AI including Gemini to find target email addresses, run OSINT and translate lure content ^[12]. Ravine Castle spans the full lifecycle and adds propaganda generation and research into anonymizing leaked data for onward distribution to journalists and influencers ^[13]. Midnight Neptune, DPRK-nexus, folds AI into operations supporting cryptocurrency theft ^[14]. One unnamed PRC group is described as experimenting with AI development tools toward an automated exploitation and post-exploitation pipeline ^[10]. That is assistance to human operators in every case but the experiment.

So the compression is measured on one side of the ledger. The material carries no defender figure at all: no detection time, no staffing, no budget ^[20]. Google's stated response is disabling adversary projects and accounts as it finds them, plus model hardening that includes real-time defenses to degrade unauthorized student models and detect attempts to clone proprietary logic ^[15]. That enforcement sits with the platform, work an enterprise SOC has no way to carry out on its own.

What an enterprise can act on is narrower and already known. TeamPCP's delivery path is the package registries ^[3], its stealer is documented ^[4], and its tooling is in public hands ^[5]. GTIG's own diagnosis is that AI's facility at finding vulnerabilities and writing exploits keeps the force multiplier in place ^[16], which puts the six hours at the low end of what to expect going forward.