On September 8, Google Threat Intelligence Group (GTIG) detailed several attacks that show how quickly AI is changing the economics of cybercrime.
In one credential-harvesting campaign, a threat actor first compromised an organization’s cloud infrastructure, then built and deployed a multi-agent attack framework. The operation took less than six hours in total and resulted in thousands of third-party credentials being compromised.
The AI even managed parts of the vulnerability-scanning pipeline, troubleshot problems as they arose and rotated IP addresses with minimal human intervention.
One of the main benefits of AI for organizations is the productivity gains it can deliver. Unfortunately, threat actors can use those same capabilities to make attacks faster and easier to scale. Credentials are already routinely harvested through infostealers, and AI simply removes some of the work required to carry attacks out.
As credentials are becoming easier to steal at scale, security teams must ensure their current authentication processes are robust enough to confidently establish that users and devices connecting to internal networks are trustworthy.
AI is Automating the Credential Theft Playbook
Microsoft reported in April that AI-assisted phishing campaigns it observed were achieving click-through rates as high as 54%, compared with around 12% for traditional campaigns.