Google’s Threat Intelligence Group finds state-sponsored hackers using generative AI throughout familiar attack workflows: researching targets, creating credible personas, translating phishing messages, developing code, and abusing trusted platforms.
Actors linked to Iran, North Korea, China, and Russia used tools including Gemini during the final quarter of 2025. The report does not identify a breakthrough that changes the threat landscape.
Instead, AI makes established techniques faster, more polished, multilingual, and scalable. Defenders must prepare for higher-quality volume rather than an entirely new species of attack.
Reconnaissance and Phishing Become More Convincing
Iranian group APT42 used Gemini to research targets, create official-looking email identities, develop plausible pretexts, and translate natural language. Better grammar removes one of the signals employees have traditionally used to identify phishing.
North Korean actor UNC2970 profiled defence and cybersecurity companies, technical roles, and salary information while impersonating recruiters. The research resembles legitimate professional activity until it becomes a tailored social-engineering campaign.
Security awareness should therefore move beyond awkward wording. Employees need to verify identity through independent channels, treat unexpected recruitment or document requests cautiously, and report interactions that become unusually specific.
Organisations can reduce exposed information about teams and systems, strengthen email authentication, and monitor for impersonation. High-value defence and technology employees require role-specific preparation.
Attackers Also Target and Embed AI Models
Google observed extraction campaigns using more than 100,000 prompts to elicit Gemini’s reasoning across languages and tasks. These distillation attempts seek to copy proprietary capability rather than compromise a conventional account.
GTIG also identified HONESTCUE, malware that sends prompts to Gemini’s API, receives C# code, and compiles a fileless second stage in memory. COINBAIT, a cryptocurrency phishing kit, appears to have been accelerated by AI code generation.
In ClickFix campaigns, attackers used public sharing features from Gemini, ChatGPT, Copilot, DeepSeek, and Grok to host realistic instructions containing malicious commands. Trusted AI domains became the first stage of malware delivery.
Enterprises should treat shared chat links as untrusted content, restrict script execution, monitor unusual API usage, and protect model credentials like any powerful production secret.
Commercial Tools and Stolen Keys Lower the Barrier
Underground services often claim to be bespoke malicious models. Google found that Xanthorox actually relied on several commercial AI products accessed through stolen API keys.
This suggests attackers face the same cost and capability constraints as legitimate developers and frequently prefer mature services. Account security, anomaly detection, rate limits, and rapid credential revocation can disrupt their operations.
Google disabled associated accounts and projects and used threat intelligence to improve model refusals and classifiers. Provider action is useful but cannot replace endpoint, identity, email, and network defence.
Security teams should expect attackers to alternate among platforms as controls change. Indicators based solely on one model or provider will age quickly; behavioural detection remains more durable.
Training should evolve with the threat. Employees need examples of polished, context-aware lures rather than obvious spelling mistakes, while incident teams should rehearse campaigns that change rapidly after initial access. Providers can help by sharing abuse patterns quickly, but organisations must assume that useful detection signals will be copied, modified, and distributed across multiple models.
The report’s most important message is proportional. AI is amplifying reconnaissance, phishing, code production, and obfuscation, but state actors have not gained magical access. Established controls still matter when adapted to more persuasive and rapid campaigns.
Defenders can use AI for triage, detection engineering, and analysis while maintaining human judgment around attribution and response. The contest is partly about speed, but also about operational discipline.
State-sponsored hackers are using AI because it is useful, available, and efficient—not because it makes traditional security irrelevant. Enterprises should update assumptions about quality and volume while continuing to protect identities, systems, and people at every familiar point in the attack chain.
