Menu
SUBSCRIBE
SUBSCRIBE
Menu

Credential Theft

Google Cloud logo amid linked server clouds and orange data paths, on AI agents running a credential-theft operation

AI Agents Help Attacker Steal Thousands of Credentials in Under Six Hours, Google Says

, , , , , , , , , , ,

The human-led operation reached a scale normally associated with larger hacking groups and sent attack traffic through a victim company’s legitimate internet addresses.

 

Key Takeaways

  • A suspected financially motivated attacker used AI agents to build and run a large credential-theft operation in less than six hours.
  • The attacker supplied the objectives and instructions, while the agents managed much of the scanning and credential theft without constant human direction.
  • Google found a separate automated system managing more than 23,800 stolen credentials and digital access keys.

A suspected financially motivated attacker used AI agents to build and carry out a large credential-theft operation in less than six hours, according to a new Google Threat Intelligence Group report.

The operation compromised thousands of credentials and reached a scale that Google said would normally be associated with a larger, better-resourced hacking group.

The attacker first accessed an organization’s cloud infrastructure. The attacker used an AI coding tool to build the operation and gave AI agents written playbooks to scan vulnerable systems and steal credentials.

Human operators remained in control of the overall attack. The AI agents handled much of the work of finding vulnerable systems and stealing the information needed to access them.

By running the attack through the victim’s cloud systems, the attacker could send malicious traffic from legitimate internet addresses associated with a real organization. This made the traffic more difficult to distinguish from normal activity.

AI agents kept the attack running with limited oversight

The written instructions told the agents how to complete their assigned tasks.

The agents managed the system that scanned for vulnerable targets and attempted to steal credentials. When the operation encountered technical problems, the agents adjusted their actions and continued without waiting for human operators to step in.

They also changed the internet addresses used to send attack traffic. Google said this reduced the ongoing attention required from the human attacker.

The case showed attackers moving beyond using AI only to answer questions or write malicious code. Google said some attackers are now assigning multiple parts of an operation to groups of AI agents.

Separate AI system managed stolen access at scale

Google also discovered an exposed server hosting a separate automated system built to find vulnerable systems and manage stolen access.

The system included a dashboard designed to organize and verify more than 23,800 stolen credentials and other access information, including digital keys for cloud and AI services.

Google said AI agents connected to the system could identify weaknesses, scan internet-facing systems, and attempt to exploit them with little human involvement.

Google has not seen fully autonomous attacks

Google said it has not yet observed a fully autonomous system select a target and carry out an entire attack without human involvement.

Instead, the report describes a gradual shift in which human attackers retain overall control while assigning more operational work to AI.

The report also documented attackers stealing proprietary AI models and related research from companies, sometimes for extortion. In separate software supply-chain attacks, malicious files contained instructions designed to manipulate AI coding assistants or make AI security scanners skip reviewing harmful code.

Google said it disabled accounts and other assets connected to the activity and used the findings to strengthen its models’ safeguards against similar misuse.

 

While no fully autonomous attack has been reported, the UK’s AI Security Institute (AISI) ran simulated, fully autonomous attacks using Claude Mythos earlier this year.

Pink and orange brain-and-gear symbol illustrating Microsoft research on AI infrastructure attacks.

Attackers Target AI Infrastructure to Steal Credentials

, , , , , , , , , , , ,

Microsoft documented compromises of three software platforms, LiteLLM, RAGFlow, and Kestra, that also gave attackers lasting access and hijacked computing power.

Key takeaways

  • Microsoft documented real attacks on installations of LiteLLM, RAGFlow, and Kestra, three software platforms used to operate AI and other business systems.
  • Attackers entered through exposed or vulnerable software. They attacked the infrastructure surrounding AI models, not the models themselves.
  • The attackers stole AI provider credentials, maintained access to compromised systems, and used company computing power to mine cryptocurrency.
  • Microsoft said AI infrastructure should receive the same security protections as other critical company systems.
  • The research did not identify the affected organizations, the attackers, or how widespread these attacks have become.

Microsoft Security Research documented attacks against three AI infrastructure systems that allowed attackers to steal credentials, maintain access, and use company computing resources for cryptocurrency mining.

The AI infrastructure attacks involved LiteLLM, RAGFlow, and Kestra. These systems perform different jobs, but each can connect AI models with company applications, stored information, credentials, and computing resources.

That access made the systems valuable targets. Microsoft said attackers used different entry points but repeatedly pursued credentials, lasting access, data, and computing power.

Microsoft did not identify the affected organizations or the attackers. Its research describes three investigations and does not establish how common such attacks have become.

LiteLLM attackers stole keys and database records

LiteLLM serves as a gateway between company applications and AI model providers. It can hold API keys, which are secret codes that authorize access to services from companies such as OpenAI, Anthropic, and Microsoft.

Microsoft said attackers likely entered through security weaknesses in an internet-accessible LiteLLM gateway. They searched the system for AI provider keys, passwords, database connection details, and other credentials.

The attackers then used a stolen database connection to access records containing AI model settings and additional keys. Microsoft also observed attempts to send the stolen information to attacker-controlled systems.

The attack went beyond credential theft. The attackers installed cryptocurrency-mining software, added an SSH key that could provide continued access, and created processes intended to survive system restarts and resist removal.

RAGFlow attack intercepted new AI credentials

RAGFlow helps AI systems search and use information stored in documents. It also stores the credentials needed to connect with AI model providers.

In the case Microsoft investigated, attackers changed the RAGFlow application to capture newly entered AI provider credentials and send them outside the organization. The malicious code was connected to the application’s startup process, allowing it to load again when the service restarted.

Microsoft said it could not determine which security weakness enabled the attackers to run code inside RAGFlow. It identified several publicly reported weaknesses that could provide context but did not attribute the attack to any one of them.

Microsoft did not observe cryptocurrency mining or an interactive remote connection in this case. The attack primarily targeted credentials entered after the malicious code was installed.

Kestra attackers hijacked computing power

Kestra lets organizations automate tasks across software and computing systems. Microsoft said attackers likely exploited a security weakness that allowed them to bypass its login protections and create a malicious automated task.

That task allowed the attackers to run commands, inspect information held by connected software containers (isolated environments used to run applications), and collect credentials and other data.

The attackers also installed XMRig, software used to mine the Monero cryptocurrency. This allowed them to consume the organization’s computing power for their own profit.

Microsoft observed later activity that collected additional system information and stored it through Kestra’s own data-storage feature.

Microsoft urges tighter controls

Microsoft recommended that organizations prevent AI management tools from being directly accessible through the internet and install security updates promptly.

The company also recommended issuing separate AI service keys to individual teams, limiting how much each key can spend, and storing master credentials outside the applications that use them. Organizations should replace credentials associated with an exposed system.

Microsoft said organizations should limit what AI infrastructure can access and monitor it for signs of unauthorized activity.

Abstract blue and green graphic with white vertical bars accompanying coverage of the ChainDrop attack.

ChainDrop Attack Compromises More Than 400 Software Packages

, , , , , , , , , , ,

Microsoft found the malware stole credentials from developer computers and build systems, then used publishing access to spread to additional packages automatically.

 

Key Takeaways

  • Microsoft found malicious updates in more than 400 software packages distributed through npm, the world’s largest software library containing over 80,000 software packages.
  • The malware stole passwords and digital access keys that could give attackers access to company code, cloud accounts, and other systems.
  • Stolen publishing access allowed the malware to insert itself into additional packages and release infected updates automatically.
  • The attack planted instructions that could reactivate the malware when developers later used Claude or Visual Studio Code.

Microsoft Security found the ChainDrop attack compromised more than 400 software packages distributed through npm, the world’s largest software library containing over 80,000 software packages.

The affected packages came from unrelated publishers. Microsoft said many infected versions appeared to be routine updates, even though the packages’ public development records showed no legitimate code changes behind them.

Microsoft identified the malware as a version of Mini Shai-Hulud, a credential-stealing worm that can spread itself. The malicious code could run automatically before a package finished installing.

Malware searched for company credentials

Once active, the malware searched developer computers and automated software build systems for credentials stored in files, software tools and system memory. Software build systems are company systems that assemble code and prepare software for release.

The credentials could provide access to npm, GitHub, Amazon Web Services, Kubernetes and HashiCorp Vault. Those services can contain software code, cloud resources, and passwords or other information used to access company systems.

The malware checked which services the stolen credentials could access and collected additional information available through those accounts. It encrypted the collected data and sent it to an attacker-controlled web address.

Stolen access helped the attack spread

The malware used stolen npm publishing credentials to infect additional software packages automatically.

It downloaded the latest version of each package the compromised publisher could update, inserted the malicious code, and released a new version. One stolen publishing credential could therefore produce infected updates across multiple packages maintained by the same developer or organization.

Microsoft said the malicious releases often appeared as ordinary small updates. In some cases, the malware could use trusted software publishing systems, allowing an infected release to carry records showing that it came through a legitimate process.

Claude files created another infection route

The malware also used stolen GitHub credentials to plant instructions for Anthropic’s Claude and Microsoft’s Visual Studio Code in software projects stored on GitHub.

Those instructions could reactivate the malware when developers later worked on the affected projects using Claude or Visual Studio Code. This created another route for the infection to move between developers working with the affected repositories.

Microsoft tells affected companies to replace credentials

Microsoft said companies that installed an affected package and allowed its setup commands to run should treat the associated developer computer or build system as potentially compromised.

The company recommended replacing exposed credentials from a computer known to be clean. It also advised rebuilding affected systems and any software created on them from trusted sources.

Security teams should check for unauthorized package releases, unexpected changes to software repositories and build processes, and suspicious access to cloud accounts or stored credentials.

Microsoft said the investigation remains active and advised companies to monitor for updated information about affected package versions and newly identified attacker activity.Microsoft Security found the ChainDrop attack compromised more than 400 software packages distributed through npm, a service developers use to download code. The malware stole passwords and access keys, used stolen publishing access to infect more packages automatically, and planted instructions that could reactivate it when developers later used Claude or Visual Studio Code.

Glowing red spiral of data strands with binary code symbolizing AI carrying out cyberattacks, Check Point AI Security Report 2026

AI Is Moving From Assisting Cyberattacks To Carrying Them Out, Check Point Warns

, , , , , , , , , ,

The AI Security Report 2026 says AI is increasingly being trusted to perform tasks once handled by human hackers, raising new concerns as businesses connect AI systems to internal tools and data.

 

Key Takeaways

Check Point says AI is starting to carry out parts of cyberattacks that once required skilled human hackers. The company cites incidents in which AI systems performed reconnaissance, exploitation, and credential theft, supporting its argument that AI has moved beyond its role as a coding assistant.

The tools that let AI systems interact with company data are still immature. Check Point found security weaknesses in 40% of the 10,000 Model Context Protocol (MCP) servers it analyzed, raising concerns about how quickly businesses are expanding AI access to internal systems. 

AI coding tools increase the risk that employees will inadvertently expose company systems. Check Point found hundreds of public software packages containing Claude Code configuration files, some of which included live credentials. 

 

Check Point Software says AI crossed an important threshold in cybersecurity. In its AI Security Report 2026, the company finds that AI is no longer simply helping attackers write code or search for vulnerabilities. Instead, it is increasingly carrying out parts of cyberattacks itself.

According to Check Point, AI systems are already performing parts of cyberattacks that once required skilled human operators, allowing attackers to automate more of the process.

“The most significant shift this report documents is not a new technique. It is pace,” Check Point wrote, arguing that AI is making cyberattacks faster, cheaper, and less dependent on human expertise. 

AI takes on a larger role in attacks

Check Point says attackers are increasingly using AI to automate parts of cyberattacks that once required skilled human operators.

The report cites a Chinese-linked espionage campaign in which AI systems reportedly conducted much of the reconnaissance, exploitation, and credential theft across roughly 30 organizations. In another case, investigators reconstructed thousands of commands executed during a breach of Mexican government agencies.

Companies are giving AI more access to internal systems

Businesses are giving AI assistants broader access to internal systems, creating new security risks as the technology spreads across the enterprise.

Check Point found security weaknesses in 40% of the 10,000 Model Context Protocol, or MCP, servers it analyzed. MCP servers allow AI assistants to connect to company software, databases, and other tools.

AI coding tools are exposing sensitive information

The growing use of AI coding tools is creating new ways for companies to inadvertently expose sensitive information.

After scanning roughly 46,500 public software packages, Check Point discovered that 428 had accidentally exposed Claude Code settings files, some of which contained credentials that could provide access to internal systems and AI services.

Attackers are targeting AI infrastructure

As businesses rely more heavily on AI tools, attackers are increasingly targeting the systems and software that support them.

The report highlights GlassWorm, a self-propagating malware strain that hid within developer tools and spread across more than 150 software repositories. According to Check Point, the malware used AI-generated commit messages to blend in with legitimate development activity while stealing API keys and inserting malicious MCP servers.

 

Check Point’s AI Security Report 2026 draws on incident investigations, scans of ~46,500 public software packages, and an analysis of 10,000 MCP servers conducted by the company’s AI Security Research team.