An attacker used an AI coding chatbot and compromised cloud infrastructure to harvest thousands of third-party credentials in under six hours, Google’s Threat Intelligence Group (GTIG) said. Mandiant observed the suspected financially motivated campaign in the second quarter of 2026, according to a Sept. 8 report.
Google said the actor first gained access to an organization’s cloud environment, then gave the chatbot a prompt and written operating instructions. The chatbot ran vulnerability scans, adapted when tasks hit problems and rotated IP addresses automatically, the report said. The attacker routed activity through the compromised cloud system, enabling the use of IP addresses Google characterized as legitimate.
Google did not identify the suspected actor or the organization whose cloud resources were used. It also did not give an exact credential count or detail what happened to the stolen credentials afterward.
GTIG described the incident as part of a broader shift toward AI systems that can manage several attack stages with less human direction. The group said its analysis drew on Mandiant incident-response engagements, threat tracking and Google platform defenses.
Cybersecurity startup Cyfendo is marketing an AI-assisted tool for examining software code. The company says its platform analyzes source code, investigates supported vulnerabilities, prepares fixes and tests findings again; developers decide whether to approve proposed changes. Cyfendo identifies Bryan Vuong as its founder and CEO and says he held engineering leadership roles at Google and Meta. In a Thursday, Oct. 15, announcement, Vuong said, “What worries me is the gap between increasingly powerful attack capabilities and the resources ordinary businesses have to defend themselves.”
The FBI’s Internet Crime Complaint Center recorded 1,008,597 complaints and $20.877 billion in reported losses across internet crimes in 2025. Reported losses rose 26% from 2024; the figures cover offenses including fraud and do not isolate AI-enabled crime or credential theft. The U.S. Small Business Administration’s Office of Advocacy counted 36.2 million U.S. small businesses in its 2025 profiles, including 4.34 million in California.
