Tool
Gemini CLI
- First Reported
- Apr 28, 2026
- Latest Reported
- Jul 15, 2026
Reported Context (2)
- A Russian-speaking threat actor known as “bandcampro” abused Google’s Gemini CLI as a hacking agent to run and maintain a small botnet, migrate its C2 infrastructure, and access a dental clinic’s OpenDental database. Trend Micro: Threat Actor Used Gemini CLI to Operate Botnet Targeting Dental Clinic
- By adding RL’s MCP server to the Gemini CLI, the LLM can easily fetch RL data about @solana-launchpad/sdk package and clarify to the user why they shouldn’t use it in their code (Figure 15). ReversingLabs Details PromptMink Supply-Chain Campaign Targeting AI Coding Agents
Malware (1)
Threat Actors (2)
MITRE ATT&CK (15)
Vendors (3)
Products (7)
Tools (4)
Industries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.