Google Says Hackers Likely Used AI to Develop Zero-Day Exploit for Web Admin Tool
Summary
Google’s Threat Intelligence Group says an exploit for an unnamed open-source web administration tool’s 2FA was likely developed with AI. Google says it disrupted the attack before mass exploitation and cites code traits supporting its assessment.
Key points
- GTIG says a zero-day exploit targeting an unnamed open-source web administration tool could bypass its two-factor authentication.
- Google assesses that an AI model likely generated the Python exploit, citing educational docstrings, a hallucinated CVSS score, and textbook-style code structure.
- Google describes the flaw as a high-level semantic logic bug; the LLM used is unknown, and Google says Gemini was not involved.
- Google says it notified the developer and disrupted the attack before mass exploitation.
- Google also reported AI use in vulnerability discovery and exploit development by actors including APT27, APT45, UNC2814, UNC5673, and UNC6201, and AI-generated decoy code in CANFAIL and LONGSTREAM.
- Google highlighted the Overload operation’s use of AI voice cloning in fake videos and PromptSpy’s use of Gemini APIs and an automation agent to interact with Android devices.
Article Details
- Event Type
- Google Threat Intelligence Group reported a likely AI-generated zero-day exploit targeting an unnamed open-source web administration tool.
- Impact
- The exploit could bypass the tool's two-factor authentication. Google says the attack was disrupted before mass exploitation and that the software developer was notified. The report also describes other threat activity involving AI-assisted vulnerability discovery, malware, and social engineering.
Threat Actors
APT45Google reports that APT45, among other named groups, has been using AI models for vulnerability discovery and exploit development.SHORE CASTLEGoogle reports that APT27, among other named groups, has been using AI models for vulnerability discovery and exploit development.UNC2814Google reports that UNC2814, among other named groups, has been using AI models for vulnerability discovery and exploit development.UNC5673Google reports that UNC5673, among other named groups, has been using AI models for vulnerability discovery and exploit development.UNC6201Google reports that UNC6201, among other named groups, has been using AI models for vulnerability discovery and exploit development.
Malware
CANFAILThe report also links AI use to other threat activity involving APT27, APT45, UNC2814, UNC5673, UNC6201, CANFAIL, LONGSTREAM, Overload, and PromptSpy.LONGSTREAMThe report also links AI use to other threat activity involving APT27, APT45, UNC2814, UNC5673, UNC6201, CANFAIL, LONGSTREAM, Overload, and PromptSpy.PromptSpyThe report also links AI use to other threat activity involving APT27, APT45, UNC2814, UNC5673, UNC6201, CANFAIL, LONGSTREAM, Overload, and PromptSpy.
Products
AndroidThe PromptSpy backdoor for Android, documented by ESET earlier this year, is also highlighted in Google’s report for its integration with Gemini APIs for autonomous device interaction.GeminiThe large language model (LLM) used for the malicious task remains unclear, but Google rules out the possibility that Gemini was involved in the process.