{"id":423163,"date":"2026-05-12T02:03:17","date_gmt":"2026-05-12T02:03:17","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/423163\/"},"modified":"2026-05-12T02:03:17","modified_gmt":"2026-05-12T02:03:17","slug":"google-threat-report-warns-ai-driven-cyber-operations-are-scaling-across-global-threat-landscape","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/423163\/","title":{"rendered":"Google Threat Report Warns AI-Driven Cyber Operations Are Scaling Across Global Threat Landscape"},"content":{"rendered":"

Tuesday, 12 May 2026, 12:07 pm
Press Release: Google Threat Intelligence Group – GTIG<\/a><\/p>\n

Cyber threat actors are increasingly integrating
\nartificial intelligence into real-world cyber operations,
\naccording to a new report from Google Threat Intelligence
\nGroup (GTIG), which warns the technology is now being used
\nto accelerate everything from vulnerability research to
\nphishing, malware development and disinformation
\ncampaigns.<\/p>\n

The latest GTIG AI Threat Tracker report
\nhighlights growing activity from state-sponsored and
\ncriminal actors linked to China, North Korea and Russia,
\nwith researchers observing a shift from experimental AI use
\ntoward more mature and operationalised attack
\nworkflows.<\/p>\n

GTIG said actors associated with the
\nPeople\u2019s Republic of China (PRC) and the Democratic
\nPeople\u2019s Republic of Korea (DPRK) are showing significant
\ninterest in using AI for vulnerability discovery and exploit
\ndevelopment. Researchers observed the use of specialised
\nvulnerability datasets and expert-style prompting techniques
\nto improve exploit generation capabilities.<\/p>\n

The report
\nalso details what researchers believe may be one of the
\nfirst known cases of AI-assisted zero-day exploit
\ndevelopment by cybercriminals. GTIG identified a
\nvulnerability exploitation campaign involving a two-factor
\nauthentication bypass vulnerability likely discovered and
\nweaponised using AI tools.<\/p>\n

Beyond exploit development,
\nGTIG warned that AI is increasingly being integrated into
\nmalware and operational infrastructure. The report
\nidentified activity linked to PRC-nexus group APT27 using
\nGemini to accelerate development of tools likely supporting
\noperational relay box infrastructure designed to obscure
\nattack origins.<\/p>\n

Advertisement – scroll to continue reading<\/p>\n

Meanwhile, suspected Russia-linked
\nthreat actors targeting Ukrainian organisations were found
\nusing AI-generated decoy code inside malware families such
\nas CANFAIL and LONGSTREAM to help evade detection and
\ncomplicate forensic analysis.<\/p>\n

One of the report\u2019s
\nmore concerning findings relates to the emergence of
\nautonomous AI-enabled malware. GTIG detailed how Android
\nbackdoor PROMPTSPY uses Gemini to analyse device interfaces,
\ndetermine actions and autonomously interact with infected
\ndevices.<\/p>\n

Researchers said PROMPTSPY demonstrates a
\nbroader shift toward AI-enabled attack orchestration, where
\nmalware can interpret system states and carry out actions
\nwithout requiring continuous human oversight.<\/p>\n

The
\nreport also highlights increased use of AI for
\nreconnaissance and phishing operations. Threat actors were
\nobserved using large language models to generate detailed
\norganisational hierarchies, map third-party relationships
\nand identify likely phishing targets within
\nenterprises.<\/p>\n

GTIG additionally identified a growing
\ntrend toward \u201cagentic workflows\u201d, where autonomous
\nframeworks are used to conduct reconnaissance and validate
\nvulnerabilities at scale. Researchers linked some of this
\nactivity to suspected PRC-nexus operations targeting
\norganisations in Asia.<\/p>\n

The report also documents how
\nAI-generated media is being incorporated into influence
\noperations. GTIG identified suspected AI voice cloning
\nactivity associated with pro-Russia campaign \u201cOperation
\nOverload\u201d, which used manipulated video content designed
\nto imitate legitimate journalism.<\/p>\n

Google said threat
\nactors are also attempting to industrialise access to
\nfrontier AI models through automated registration pipelines,
\nproxy infrastructure and account pooling services designed
\nto bypass safety restrictions and account bans.<\/p>\n

At the
\nsame time, AI systems themselves are increasingly becoming
\ntargets. GTIG identified malicious OpenClaw skill packages
\nand broader supply chain attacks affecting AI-related
\nplatforms and repositories including LiteLLM and
\nBerriAI.<\/p>\n

Despite these developments, Google said AI is
\nalso strengthening defensive capabilities. The company
\nhighlighted projects such as Big Sleep, an AI-powered
\nvulnerability discovery agent, and CodeMender, an
\nexperimental system designed to automatically patch software
\nflaws.<\/p>\n

\n\u00a9 Scoop Media<\/a>
\n
\n<\/p>\n

Using Scoop for work?<\/p>\n

Scoop is free for personal use, but you”ll need a licence for work use. This is part of our Ethical Paywall and how we fund Scoop. Join today with plans starting from less than $3 per week, plus gain access to exclusive Pro features.<\/p>\n

Join Pro Individual<\/a>
\nFind out more<\/a><\/p>\n

\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Tuesday, 12 May 2026, 12:07 pmPress Release: Google Threat Intelligence Group – GTIG Cyber threat actors are increasingly…\n","protected":false},"author":2,"featured_media":35750,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[365,15743,219,217111,1702,217112,111,24636,139,69,1460,39761,11112,145,150730,24641],"class_list":["post-423163","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ai","tag-cyber-threat","tag-economy","tag-google-threat-intelligence-group-gtig","tag-infrastructure","tag-malware-development","tag-new-zealand","tag-newsworthy","tag-newzealand","tag-nz","tag-phishing","tag-sci-tech","tag-scoop","tag-technology","tag-world-asia","tag-world-united-states"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/423163","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=423163"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/423163\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/35750"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=423163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=423163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=423163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}