Full Report
Threat actors are continuing to leverage artificial intelligence (AI) to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat Intelligence Group (GTIG) said it has observed attackers with diverse motivations targeting proprietary AI
Analysis Summary
# Incident Report: Autonomous Multi-Agent Credential Harvesting Campaign
## Executive Summary
A financially motivated threat actor, identified as TeamPCP, utilized an autonomous multi-agent AI framework to conduct a large-scale credential harvesting campaign, compromising thousands of credentials in under six hours. The attack targeted developers and AI assets across the healthcare, government, and media sectors to facilitate extortion and unauthorized AI workload hosting. The incident underscores a significant shift toward "agentic" AI attacks that outpace traditional human-led response times.
## Incident Details
- **Discovery Date:** September 08, 2026 (Public Reporting)
- **Incident Date:** March – April 2026 (Initial SANDCLOCK wave); April 2026 – Ongoing (DUSTMAKER wave)
- **Affected Organization:** Multiple (Proprietary AI research firms, developers)
- **Sector:** Healthcare, Government, Media, and Technology (Open-source supply chains)
- **Geography:** Global (China-nexus activity also noted)
## Timeline of Events
### Initial Access
- **Date/Time:** Circa March/April 2026
- **Vector:** Software Supply Chain Compromise
- **Details:** Attackers targeted PyPI, npm, and Docker Hub to inject malicious code into widely used packages and container images.
### Lateral Movement
- **Details:** Use of the SANDCLOCK tool to interact with Kubernetes environments and perform container escapes to move from compromised containers to underlying cloud infrastructure.
### Data Exfiltration/Impact
- **Details:** Massive harvesting of developer credentials, cloud API keys, and cryptocurrency wallets. Proprietary AI models, research, prompts, and source code were exfiltrated for extortion purposes.
### Detection & Response
- **How it was discovered:** Observed by Google Threat Intelligence Group (GTIG) during monitoring of adversarial AI evolution.
- **Response actions taken:** Intelligence sharing by GTIG; monitoring of China-nexus threat actor UNC6508 and TeamPCP (UNC6780) activity.
## Attack Methodology
- **Initial Access:** Supply chain poisoning (PyPI, npm, Docker Hub).
- **Persistence:** Co-opting victim cloud environments to sustain unauthorized AI workloads.
- **Privilege Escalation:** Container escape functionality within the SANDCLOCK payload.
- **Defense Evasion:** Use of prompt injection within AI assistant workspaces and deployment of local, open-weight LLMs to bypass commercial AI provider monitoring.
- **Credential Access:** Deployment of SANDCLOCK (Python/Linux) and DUSTMAKER (JavaScript/CI-CD) stealers.
- **Discovery:** Automated penetration testing frameworks developed using Gemini AI to observe target states.
- **Lateral Movement:** Kubernetes exploitation and cloud environment pivoting.
- **Collection:** Targeting of AI coding assistants, developer workspaces, and proprietary AI research.
- **Exfiltration:** Theft of proprietary models and "distillation attacks" against visual/audio AI capabilities.
- **Impact:** Mass credential compromise within a six-hour window; resource theft for AI processing.
## Impact Assessment
- **Financial:** High; monetization via direct sale of credentials and partnerships with ransomware/extortion groups.
- **Data Breach:** Thousands of credentials, API keys, and proprietary AI research/models stolen.
- **Operational:** Unauthorized use of cloud resources to host attacker AI workloads.
- **Reputational:** Significant risk to open-source platforms (PyPI/npm) and proprietary AI developers.
## Indicators of Compromise
- **Network indicators:** Activity involving unauthorized connections to Docker Hub, npm, and PyPI registries from CI/CD pipelines.
- **File indicators:**
- `SANDCLOCK` (Python-based Linux malware)
- `DUSTMAKER` (JavaScript-based CI/CD payload)
- **Behavioral indicators:** Rapid, high-volume credential harvesting within a <6 hour window; anomalous prompt injection patterns in AI assistant workspaces.
## Response Actions
- **Containment measures:** Identification and removal of poisoned packages from open-source repositories.
- **Eradication steps:** Termination of unauthorized AI workloads in compromised cloud environments.
- **Recovery actions:** Resetting of developer credentials and API keys; hardening of CI/CD pipelines against JavaScript-based payloads.
## Lessons Learned
- **Key takeaways:** Threat actors have achieved "agentic" autonomy, allowing them to execute full attack lifecycles faster than human defenders can react.
- **What could have been done better:** Enhanced monitoring of AI assistant workspaces for prompt injection and stricter validation of third-party dependencies in CI/CD pipelines.
## Recommendations
- **Prevention measures:**
- Implement mandatory Multi-Factor Authentication (MFA) for all cloud and developer credentials.
- Utilize automated software bill of materials (SBOM) scanning to detect poisoned upstream dependencies.
- Deploy AI-specific security monitoring to detect prompt injection and "distillation" attempts against proprietary models.
- Limit the permissions of AI coding assistants to prevent them from accessing sensitive environment variables or broad workspaces.