The exploit was real, and the plan was mass exploitation. A criminal group built it with AI help; Google's Threat Intelligence Group found it first, worked with the vendor on a fix, and disrupted the operation before it ran. Neither the group nor the tool, a popular open-source web administration platform, has been named.
The Python script bypassed 2FA — it needs valid credentials to start — by exploiting a hardcoded trust assumption in the enforcement logic, the kind of semantic flaw scanners miss. GTIG has high confidence an AI model helped: educational docstrings, textbook Pythonic structure, a hallucinated CVSS score. It doesn't believe Gemini was used.
State actors are scaling the same approach: China's UNC2814 posed as a binary security expert to get Gemini auditing TP-Link firmware, and North Korea's APT45 fired thousands of recursive prompts at CVEs and PoC exploits. GTIG notes frontier models still struggle with complex enterprise authorization logic.
PROMPTSPY is the sharper end: an Android backdoor that reads the on-screen UI, sends it to gemini-2.5-flash-lite, and acts on the JSON commands it gets back — clicking and swiping through the device unsupervised. No PROMPTSPY apps reached Google Play, and Play Protect covers known versions.
Russian operators padded CANFAIL and LONGSTREAM with LLM-written decoy code — 32 daylight-saving queries in one downloader — so malware reads as benign. TeamPCP monetised credentials stolen via SANDCLOCK through ransomware partnerships. Google disabled the accounts involved; the Big Sleep agent found the flaw in time, and CodeMender, which proposes fixes, is still experimental.
Source: Cybersecurity News
