Google Says Threat Actor Used AI to Develop Zero-Day 2FA Bypass
Summary
Google says an unknown actor likely used an AI model to discover and weaponize a zero-day 2FA bypass in an unnamed admin tool. Its report also details PromptSpy’s Android surveillance and persistence capabilities and other threat actors’ AI abuse.
Key points
- Google assessed with high confidence that an unknown actor used an AI model to discover and weaponize a zero-day 2FA bypass in an unnamed open-source web administration tool; exploitation required valid credentials.
- The Python exploit script had traits Google associated with LLM-generated code, including educational docstrings and a hallucinated CVSS score.
- Google worked with the tool’s vendor to fix the flaw and disrupt the activity.
- PromptSpy, an Android malware, uses Gemini-related techniques to interpret screens and monitor activity, capture biometric authentication gestures, and block uninstall attempts with an invisible overlay.
- PromptSpy can dynamically update C2 infrastructure, Gemini API keys, and a VNC relay server. Google said it disabled related assets and found no infected apps on the Play Store.
- Google also reported AI use by threat actors including UNC2814, APT45, and APT27, and identified AI-enabled malware called CANFAIL and LONGSTREAM.
Article Details
- Event Type
- Google reported likely AI-assisted discovery and weaponization of a zero-day 2FA bypass, alongside other AI-enabled malware and threat-actor activity.
- Impact
- The reported exploit could bypass 2FA on an unnamed open-source web-based system administration tool, but required valid user credentials. Google said it worked with the vendor to fix the flaw and disrupt the campaign. PromptSpy can monitor Android activity, capture biometric authentication data, and obstruct uninstallation. The article also describes other threat actors using AI and related tools for vulnerability research, malware delivery, and operational support.
People
Threat Actors
AndarielNamed in the article as an alias of APT45, which reportedly used Gemini prompts to analyze CVEs and validate proof-of-concept exploits.APT45The North Korean threat actor reportedly sent repetitive Gemini prompts to analyze CVEs and validate proof-of-concept exploits.Onyx SleetNamed in the article as an alias of APT45, which reportedly used Gemini prompts to analyze CVEs and validate proof-of-concept exploits.SHORE CASTLEDescribed as a Chinese hacking group that used Gemini to speed development of a fleet-management application likely intended to manage an operational relay box network.TeamPCPIdentified as a threat actor involved in activity targeting AI environments and exposing developers to supply-chain attacks.TEMP.HexNamed in the article as an alias of UNC5673, which reportedly used publicly available tools and GitHub projects likely to facilitate scalable LLM abuse.UNC2814Described as a suspected China-nexus cyber espionage group that prompted Gemini to support vulnerability research into embedded-device targets.UNC5673Described as China-linked and as having used publicly available commercial tools and GitHub projects likely to facilitate scalable LLM abuse.UNC6201Described as China-affiliated; reportedly used a public Python script to register and immediately cancel premium LLM accounts, a method Google said could help obtain AI access at scale while avoiding account bans.
Malware
Vendors
Products
AndroidThe report also highlights multiple AI-abuse campaigns, including PromptSpy on Android, which uses Gemini-related techniques for autonomous device control, credential capture, and persistence.Claudebeen found experimenting with a specialized GitHub repository named “wooyun-legacy” that’s designed as a Claude code skill plugin featuring over 5,000 real-world vulnerability cases collected by the ChineseGeminiThe report also highlights multiple AI-abuse campaigns, including PromptSpy on Android, which uses Gemini-related techniques for autonomous device control, credential capture, and persistence.Gemini-2.5-flash“On high-risk medical benchmarks like MedQA, the accuracy of the Gemini-2.5-flash model drops precipitously, from 83.82% with the official API to approximately 37.00% across all examined shadow APIs,” the researchers
Tools
HexStrike AIElsewhere, a suspected China-aligned threat actor is said to have deployed agentic tools like Hexstrike AI and Strix in an attack targeting a Japanese technology firm and a major East Asian cybersecurity platform toStrixa suspected China-aligned threat actor is said to have deployed agentic tools like Hexstrike AI and Strix in an attack targeting a Japanese technology firm and a major East Asian cybersecurity platform to conductwooyun-legacyThreat actors have also been found experimenting with a specialized GitHub repository named “wooyun-legacy” that’s designed as a Claude code skill plugin featuring over 5,000 real-world vulnerability cases collected by
Countries
ChinaA suspected China-nexus cyber espionage group dubbed UNC2814 prompted Gemini by asking it to assume the role of a network security expert to trigger persona-driven jailbreaking and support vulnerability research intoIranGoogle also said it continues to see information operations (IO) actors from Russia, Iran, China, and Saudi Arabia using AI for common productivity tasks like research, content creation, and localization, even as itRussiaA cluster of Russia-nexus intrusion activity targeted Ukrainian organizations to deliver AI-enabled malware dubbed CANFAIL and LONGSTREAM, both of which use LLM-generated decoy code to conceal their maliciousSaudi ArabiaGoogle also said it continues to see information operations (IO) actors from Russia, Iran, China, and Saudi Arabia using AI for common productivity tasks like research, content creation, and localization, even as it
Industries
Cybersecuritylike Hexstrike AI and Strix in an attack targeting a Japanese technology firm and a major East Asian cybersecurity platform to conduct automated discovery with minimal human oversight.Technologyit said was likely developed with an artificial intelligence (AI) system, marking the first time the technology has been put to use in the wild in a malicious context for vulnerability discovery and exploit