A coalition including Google Threat Intelligence Group, TrendAI and Japan's National Police Agency disrupted a botnet of more than 1.3 million Android TV boxes and projectors spanning over 200 countries. Google says Shenzhen-based manufacturer Videostrong Technology deliberately built a backdoor called XCPE into device firmware and sold access to criminal affiliates, who installed malware modules to route traffic through unsuspecting owners' home networks. The group also took down command-and-control domains tied to affiliate modules and said it has cut ties with Videostrong, banning it from shipping devices with preloaded Google apps.
it.slashdot.org
· 2026-11-03
Google's Threat Intelligence Group disclosed a credential-harvesting operation where attackers compromised cloud infrastructure and deployed a multi-agent AI framework that scanned for vulnerabilities, fixed its own errors, and rotated IP addresses largely without human input. The entire campaign, which compromised thousands of third-party credentials, took less than six hours to execute. Separately, Microsoft found AI-assisted phishing messages reaching click-through rates of 54%, compared to roughly 12% for conventional campaigns.
bleepingcomputer.com
· 2026-09-17
Google's Threat Intelligence Group reports that attackers are moving from simple AI-assisted coding to fully autonomous, multi-agent systems that plan and execute entire attacks with little human input. In one case, a financially motivated actor compromised cloud infrastructure and used an AI coding chatbot with markdown-based agent instructions to build and run a mass credential-harvesting operation in under six hours. Separately, researchers found an exposed command-and-control server running a framework called 'Recon' that autonomously managed reconnaissance and tens of thousands of harvested credentials.
bleepingcomputer.com
· 2026-09-08
GoKawiil