Quick Summary
State-backed hackers from China, Iran, North Korea, and Russia are using Google’s Gemini AI model to facilitate various stages of cyberattacks, including reconnaissance and data exfiltration. Notable threat actors such as APT31 and APT42 have utilized Gemini for tasks like phishing lure creation and vulnerability analysis. This trend highlights the growing intersection of AI technology and cybercrime, raising significant concerns for cybersecurity and privacy.
The Securityish Brief
Google has reported that state-sponsored hackers are leveraging its Gemini AI model to enhance their cyberattack capabilities. This includes activities ranging from reconnaissance to post-compromise actions. Notable groups involved are APT31 and Temp.HEX from China, APT42 from Iran, UNC2970 from North Korea, and Russian actors. They have used Gemini for tasks such as target profiling, generating phishing lures, and conducting vulnerability testing.
For instance, a Chinese threat actor employed Gemini to automate vulnerability analysis and develop targeted testing plans in a fabricated scenario. Another actor from China frequently used Gemini to debug code and research technical capabilities for intrusions. Additionally, APT42 from Iran has utilized Gemini for social engineering campaigns, speeding up the creation of tailored malicious tools.
The report also highlights the integration of AI capabilities into existing malware families, such as the CoinBait phishing kit and the HonestCue malware downloader. HonestCue, observed in late 2025, uses the Gemini API to generate and execute malware payloads in memory. CoinBait masquerades as a cryptocurrency exchange to harvest credentials.
Cybercriminals have also shown interest in generative AI services for ClickFix campaigns, delivering the AMOS info-stealing malware for macOS through malicious ads. These activities indicate a concerning trend where AI tools are increasingly being used for illegal purposes.
Furthermore, attempts at AI model extraction and distillation have been reported, where actors use authorized API access to replicate Gemini’s functionality. This poses a significant threat to intellectual property and the business model of AI-as-a-service, potentially impacting end users.
Google has responded by disabling accounts linked to documented abuse and enhancing security measures within Gemini’s classifiers. The company emphasizes its commitment to designing AI systems with robust security and safety protocols.
Implications for Cybersecurity
This situation underscores the evolving landscape of cyber threats, where AI tools are not only used for defense but also for malicious purposes. Organizations must remain vigilant and monitor for signs of AI-assisted attacks, which may manifest in sophisticated phishing attempts or targeted intrusions.
Users should be cautious of unsolicited communications that may leverage AI-generated content to appear legitimate. Regularly updating security protocols and educating staff about the risks associated with AI in cybercrime is essential.
Key Takeaways
- Regularly update your cybersecurity protocols to counter evolving AI-assisted threats.
- Educate employees about the risks of AI-generated phishing attempts and social engineering.
- Monitor for unusual activity in your systems that may indicate AI-assisted intrusions.
- Implement strong security measures for any AI tools used within your organization.
- Stay informed about the latest trends in cyber threats involving AI technologies.
Key Terms & Concepts
- Gemini AI: In this article, Gemini AI refers to Google’s artificial intelligence model that is being exploited by hackers for various attack stages.
- APT: APT stands for Advanced Persistent Threat, which refers to prolonged and targeted cyberattack campaigns often conducted by state-sponsored groups.
- CoinBait: CoinBait is a phishing kit that masquerades as a cryptocurrency exchange to harvest user credentials.
- HonestCue: HonestCue is a proof-of-concept malware framework that uses the Gemini API to generate and execute malware payloads.
- ClickFix campaigns: ClickFix campaigns involve cybercriminals using malicious ads to deliver malware, often disguised as troubleshooting solutions.
Read the original article here: https://www.bleepingcomputer.com/news/security/google-says-hackers-are-abusing-gemini-ai-for-all-attacks-stages/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
