Google Report: AI Increasingly Integrated Into Cyberattack Chains

Artificial intelligence is shifting from experimental use to more industrialized and structured integration within offensive cyber operations. According to a new Google report, attackers are no longer using models merely as writing or research assistants, but are embedding them across multiple stages of the attack chain – from planning and code development to the autonomous execution of malicious tools.

One of the key findings in the report is that Google identified, for the first time, a case in which a cybercriminal actor likely used AI to develop an exploit for a zero-day vulnerability. According to the report, the attackers planned to use the vulnerability in a broad exploitation campaign, but early detection by Google disrupted the activity before it could be carried out. The vulnerability itself allowed bypassing two-factor authentication in an open-source-based management system, provided the attacker already had valid login credentials.

The implication is significant: artificial intelligence does not necessarily replace offensive security experts, but acts as a force multiplier. Advanced models can assist in code analysis, identify flawed assumptions, and uncover vulnerabilities that may not be detected by traditional tools such as code scanners or fuzzers. In other words, attackers gain a technical assistant that accelerates processes that previously required substantial time, knowledge, and experience.

Fake code-testing scenarios

The report also describes notable interest from threat actors linked to China and North Korea in using AI for vulnerability research. According to Google, some of this activity involved attempts to “convince” models to behave as security experts, for example by presenting fabricated code-review scenarios. In other cases, attackers used large repositories of past vulnerabilities to steer models into simulating experienced security researchers. However, vulnerability discovery is only part of the picture.

Google also describes the use of AI for malware development and obfuscation. Attackers are using models to generate confusing code, insert “dummy logic” that serves no function but complicates analysis, and build infrastructure that helps conceal the origin of their activity. The report mentions malware families such as PROMPTFLUX, HONESTCUE, CANFAIL, and LONGSTREAM, in which components or patterns suggest the use of LLMs for obfuscation, code modification, or deceptive code generation.

One of the more concerning sections of the report focuses on malware called PROMPTSPY– an Android backdoor that integrates AI capabilities to navigate infected devices. Instead of relying solely on predefined commands, the malware can send information about the device’s user interface to a model, receive structured instructions in return, and execute actions such as taps or swipes. According to Google, PROMPTSPY can also help maintain persistence on a device, resist removal, and operate more flexibly than traditional Android malware.

In simple terms, this represents a shift from pre-programmed malware to systems capable of interpreting context, making decisions, and adapting to their environment. The report also highlights widespread use of AI for intelligence gathering, reconnaissance, and attack preparation. Attackers use models to map organizational structures, identify personnel in sensitive departments such as finance, security, or HR, and craft more precise phishing campaigns. Rather than broad, generic messages, these are increasingly targeted attempts based on a deeper understanding of the organization and its employees.

Systems capable of running sequences of actions

Google further describes a shift toward “agentic” tools – systems capable of executing sequences of actions, maintaining state, selecting tools, and performing tasks autonomously. The report cites activity in which a suspected China-linked threat actor used tools such as Hexstrike and Strix against a Japanese technology company and a cybersecurity platform in East Asia, conducting reconnaissance, identifying vulnerabilities, and validating them automatically.

Another area of concern is influence operations and disinformation. According to Google, influence actors from Russia, Iran, China, and Saudi Arabia are using AI to generate content, perform localization, produce political material, and create synthetic audio. The report cites an example from a pro-Russian campaign called “Operation Overload,” which allegedly used voice cloning to impersonate real journalists and exploit the credibility of established media outlets.

At the same time, attackers are also attempting to bypass safeguards in AI systems themselves. Google describes an emerging ecosystem of intermediary services, automated account creation tools, exploitation of free-tier access, and multi-account usage to gain large-scale and anonymous access to advanced models. The goal is to use AI capabilities at scale while evading usage limits, blocks, and monitoring systems.

The report emphasizes that AI is not only a tool for attacks, it is also becoming a target. As organizations integrate models, agents, plugins, and code libraries into production environments, the AI layer itself becomes part of the attack surface. According to Google, attackers are often not breaking the models directly, but targeting surrounding components such as open-source libraries, API connectors, configuration files, plugins, and software supply chains.

A key example is activity attributed to the group TeamPCP, also known as UNC6780, which allegedly targeted multiple GitHub repositories and GitHub Actions, including components related to Trivy, Checkmarx, LiteLLM, and BerriAI. According to Google, the attackers used malicious PyPI packages and compromised pull requests to steal cloud secrets such as AWS keys and GitHub tokens, later monetizing access through partnerships with ransomware and extortion groups.

The compromise of LiteLLM is particularly significant, as the tool is used to interface with multiple model providers. A breach in such a component could expose API keys and credentials to enterprise AI systems, enabling deeper network infiltration, data theft, or large-scale reconnaissance using internal AI tools.

Google’s message is clear: the threat is not theoretical – it is already present and evolving rapidly. However, the report also notes that defenders now have a new advantage. Google says it is using AI to detect vulnerabilities, improve defenses, block malicious accounts, and develop tools such as Big Sleep and CodeMender, AI agents designed to identify and fix software vulnerabilities.

The bottom line: artificial intelligence is not creating an entirely new category of cybercrime, but it is fundamentally changing its speed, scale, and sophistication.