Security3 publishers2 min readPublished
Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours
Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.
The Watch · Security desk
What happened
- Mandiant investigated a suspected financially motivated actor that, in Q2 2026, compromised an organization's cloud infrastructure, deployed an autonomous multi-agent framework and took thousands of third-party credentials in under six hours.
- GTIG says the agent instructions managed the vulnerability scanning pipeline, performed real-time troubleshooting and executed IP rotation logic without manual intervention.
- A separate exposed operator server ran a live dashboard for organizing and validating more than 23,800 harvested secrets, including API keys for cloud and AI services.
- Google reports attackers targeting proprietary AI models in healthcare, government and media, exfiltrating API credentials and running unauthorized AI workloads inside co-opted victim clouds.
- GTIG says it has not yet observed any threat actor deploying a fully autonomous pipeline against targets in the wild.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint The scanning left the victim's own cloud, so the traffic carried legitimate IP addresses. Reputation feeds and known-bad infrastructure lists have nothing to match on, and the detection has to come from behavior inside the account.
- exposure GTIG names premium model access and high-performance compute as a primary barrier to operationalizing AI. That makes any cloud tenant with GPU quota and live AI API keys a supply of the scarce input, not only a store of data.
- capability Workspace poisoning of AI assistants and prompt injection for defense evasion appear only in DUSTMAKER, not its predecessor, which puts a developer's assistant context inside the evasion toolkit rather than the payload.
- contradiction GTIG's own curve is slower than the headline case: actors grinding public disclosures and patch delays into n-day code and working toward multi-stage chains. The six-hour campaign describes one crew's tooling, not the general standard.
The six hours covered planning and building the framework, not only running it [2]. Standing up tooling and then sitting with it through a scan is the labor that used to set campaign tempo, and per GTIG the agent instructions absorbed that labor [3].
A second operator left its own scaffolding readable. GTIG found an exposed command-and-control server running a framework called Recon, with AGENTS.md, KNOWLEDGE.md, agentic_vuln_research.md, a .openclaw/ directory and a memory/ directory all visible [5]. GTIG's characterization of the class of activity is a move from passive, endpoint-focused infostealers to offensive agentic harvesting, with agents researching vulnerabilities, scanning server-side infrastructure and executing targeted exploits [7]. The collection point moves off the laptop and onto exposed infrastructure a scanner can reach.
Where the compute comes from is tracked too. UNC6508, a China-nexus actor, is suspected of compromising cloud environments to run local open-weight LLM infrastructure rather than a commercial frontier model, which keeps the workload outside the providers' monitoring [13]. Extortion crews are separately stealing models, skills, prompts, source code and research outright [14], and Google says its own models have taken distillation attacks aimed at visual and audio understanding, image generation and video generation [15].
TeamPCP, also tracked as Altered Spider and UNC6780, carries the supply chain side: large-scale compromises of PyPI, npm and Docker Hub, credential stealers dropped afterward, and the take monetized by direct sale or partnership with ransomware and extortion groups [16]. Its tooling dates the AI-specific tradecraft. SANDCLOCK ran in March and April 2026, mostly Python, Kubernetes-aware, with container escape [17]. DUSTMAKER took over from April, cross-platform JavaScript tuned for CI/CD pipelines, no container escape, credential theft to feed extortion [18]. About one month separates first use of each, and the AI-assistant techniques arrived with the newer payload [22].
The espionage frameworks are further back. GTIG says the PRC-nexus penetration testing framework designed with Gemini stopped at attempts to build it, and the associated assets were disabled [9]. A second PRC-nexus actor used CC Switch to query Claude, Gemini or Codex for exploit scripts, spear-phishing lures and debugging, with Burp Suite and the open-source Phalanx framework doing the exploitation and Shai-Hulud handling command-and-control [10]. That is assembly from existing parts.
One timing note the report leaves implicit: the six-hour campaign was a Q2 2026 Mandiant investigation written up in the Q3 2026 tracker, so defenders got the detail at least a quarter after the fact [23]. John Hultquist of GTIG puts the consequence as criminals gravitating toward attacks faster than defenders can respond [20].
What to watch
- Whether GTIG's next tracker reports a fully autonomous pipeline run against a live target rather than an assisted one.
- Whether the 23,800 secrets from the Recon dashboard surface in extortion cases tied to a named crew.
- Whether npm, PyPI or Docker Hub publish their own accounts of the TeamPCP compromises with dates and affected package counts.