Security1 publisher2 min readPublished
Google says an agent framework harvested thousands of third-party credentials in under six hours
The actor compromised a cloud environment first and built the framework inside it. The scanning and address rotation ran with little human involvement. The credentials collected belonged to other companies.
The Watch · Security desk
What happened
- The operation ran for less than six hours in total and ended with thousands of third-party credentials compromised, according to GTIG's account.
- The framework managed parts of the vulnerability-scanning pipeline, rotated IP addresses and troubleshot problems as they arose, with minimal human intervention.
- Unit 42's 2026 Global Incident Response Report found identity weaknesses played a material role in 89% of its investigations, with attackers using stolen credentials and tokens to move through environments.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The victims who pay here are the third parties whose logins were sitting in someone else's cloud environment; they were breached through an intrusion at a company they do not control.
- capability One operator can now supervise a scan-and-harvest run that used to occupy a team, so the limit on how many run in parallel becomes how many cloud environments an actor can get into.
- constraint Controls tuned to fire on exploit attempts or unusual login mechanisms have nothing to trigger on when the credential presented is valid and the session looks like an employee's.
- decision Security teams have to decide whether to keep buying response time or to spend on binding sessions to known devices, because a correct MFA response only tells them the prompt was answered, from whatever device answered it.
The actor compromised the organization's cloud infrastructure first, then built and deployed the multi-agent framework inside it [2]. From there the framework managed parts of the vulnerability-scanning pipeline, rotated IP addresses and troubleshot its own problems as they came up, with minimal human intervention [4].
Less than six hours covered the whole operation [3]. Take the smallest number "thousands" can mean and the rate is roughly 5.6 credentials a minute sustained, including whatever time went into standing the tooling up [13].
Microsoft's April figures describe the front end of the same supply chain. In the campaigns it observed, AI-assisted phishing reached click-through rates as high as 54%, against around 12% for traditional campaigns [5]. On the same recipient list, that is a ratio of 4.5 to 1 [12].
The technique itself is old. Credentials were already being harvested at volume by infostealers, and what AI removes is some of the work involved in running the attack [10]. Verizon's Data Breach Investigation Report counts stolen credentials in 44.7% of breaches [6].
The BleepingComputer piece argues that a correct password, an MFA response or a valid session establishes only that an authentication requirement was met, and cannot by itself establish that the request came from a device the organization knows and trusts [9]. Its account of the GTIG campaign does not identify the actor, the victim, the vulnerabilities scanned, how the cloud environment was breached to begin with, or when the activity was found [14]. The record does not explain the initial compromise. That makes device-bound authentication a control against the phishing described elsewhere in the piece, and not demonstrably the one that would have stopped this harvest.
The argument arrives packaged with a read-only Active Directory scan from Specops that flags password-related weaknesses [11], and the piece notes that attackers still benefit from weak and reused passwords [15]. Those two answers leave the case at the top of the story untouched: other companies' credentials, taken at machine speed from inside a cloud environment the actor already controlled [2] [3].
What to watch
- Whether GTIG publishes attribution, the cloud provider involved, or the initial access method for the six-hour campaign.
- Whether the third parties whose credentials were harvested report follow-on intrusions, and how those credentials were used.
- Whether Microsoft's 54% AI-assisted phishing click-through figure is published with a sample size or reproduced independently.