Attacker ran AI agents from a hijacked cloud to harvest thousands of credentials in hours

Google's threat intelligence group says that in Q2 2026 Mandiant saw a suspected financially motivated actor compromise an organization's cloud infrastructure and deploy a multi-agent attack framework on it. With an AI coding chatbot, a prompt and agent instruction files, the actor planned, built and ran a mass credential harvesting campaign in under six hours, compromising thousands of third-party credentials.

Sources

• Primary: https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
• Upstream: Editorial
• Entered by the cybermap.lol editors, with sources on the entry