Six Hours From Foothold to Campaign
Google's threat intelligence team says attackers have stopped prompting models and started running agents. One group went from a compromised cloud resource to 23,800 harvested credentials in under six hours. The malware hides in your .claude directory.
On 8 September 2026 the Google Threat Intelligence Group published its update on adversarial AI. The headline finding is not a new technique. It is a clock.
In Q2 2026, GTIG observed threat actors compromise a cloud resource, then plan, build, and execute an agent-enabled mass credential harvesting campaign in under six hours.
Six hours from a foothold to a finished, running operation. One exposed command-and-control server in that campaign was managing 23,800 harvested secrets in real time.
GTIG's own framing of what changed:
Since the release of our May 2026 report... GTIG has observed forward leaning adversaries transition from basic prompting to agentic AI workflows and AI-enabled automation. In these operations, human-in-the-loop latency is dramatically reduced, compressing the traditional window for defenders to respond.
That last clause is the whole report. The window is the product.
The part that is in your repository right now
The most uncomfortable finding is a piece of malware called DUSTMAKER, and where it chooses to live.
It drops or modifies files inside the hidden project directories that AI coding assistants read: .claude, .cursor, .vscode. Not in system paths. Not in startup entries. In the folders your editor and your agent parse as a matter of routine.
GTIG is explicit about why:
By hiding files inside project folders that AI tools manage and parse, the malware blends into routine developer noise and avoids interacting with systems that endpoint detection and response (EDR) monitors.
From there it uses config files in those directories to instruct the assistant to run arbitrary commands during ordinary work. The developer asks for something normal. The agent does something else as well.
This is the same architecture as the tool-description problem covered here before: instructions and data arriving in the same channel, with the model unable to tell which is which. What is new is that it is now a named malware family with a delivery mechanism, rather than a research demonstration.
A related item from May 2026: the credential stealer ACRSTEALER pushed targeted file-grabber rules at the config stores of AI coding assistants, naming Cline's secrets file and Continue AI's config file specifically. Your agent's credential store is now an explicit collection target.
The supply chain, three ways
The report describes attackers reaching developers through the tooling rather than through the developers:
- Trojanized MCP servers, published from compromised developer accounts. If you install an MCP server, you are running someone else's code inside your agent's trust boundary.
- OIDC tokens lifted from GitHub Actions runners and used to publish signed packages. The signature is real. The signer was borrowed.
- Malicious workflows disguised as "Copilot Setup", which is a name nobody looks at twice in a pull request.
Behind these, GTIG names UNC6780, tracked as TeamPCP, running large-scale open-source supply chain compromises against PyPI, npm and Docker Hub since March 2026.
Who is doing it
The actor list reads like a map of the usual state programmes, which is itself the point. This is not a niche technique any more.
- UNC6780 (TeamPCP) and ShinyHunters (UNC6240), financially motivated
- BASIN CASTLE and RAVINE CASTLE, China-nexus, with one PRC group using Gemini to design an automated penetration testing framework
- CALANQUE ION, Iran-nexus, for reconnaissance and social engineering
- SANDWORM RELIC, Russia-nexus, for intelligence gathering and automation
- North Korean IT worker clusters, doing bulk LLM API registration on hijacked accounts
Two numbers give the scale of the demand side. Model distillation campaigns exceeding 100 million prompts, run through proxy infrastructure rotating across thousands of compromised accounts. And on underground markets, average prices per account for Claude and Gemini credentials more than doubled in 2026.
Your API key is now a traded commodity with a rising price.
What is actually new here
It is worth separating the genuinely new from the merely louder, because the report contains both.
Not new: prompt injection, supply chain attacks, credential stealers, state actors using whatever tools exist. All of that predates this by years.
New, and the reason this matters:
- The compression. Six hours from access to a running campaign. A human operator rations attention and picks the most promising path because they cannot walk all of them. An agent walks all of them, overnight, and only one has to work.
- The hiding place is a design consequence. .claude and .cursor are not obscure. They are directories your tooling is supposed to read without asking. Malware that lives there is not evading detection so much as using the trust the workflow already grants.
- Agent credentials are a collection target with a market price. Not a side effect of a broader theft. The objective.
What to do about it, concretely
None of this needs a new product. It needs the checks nobody runs.
Treat a cloned repository's agent config as untrusted input, exactly like its code. If you would not run a stranger's shell script without reading it, do not let your agent read a stranger's instruction file without reading it either. The relevant files live in .claude, .cursor and .vscode, and they are small enough to actually read.
Know what is in those directories in your own projects, so an addition is visible. On a machine checked while writing this, the only things in them were a settings file and a skills directory. That took one command and now there is a baseline to compare against.
Check whether your agent config files are tracked in version control. A planted file is usually untracked, which makes git status a surprisingly good detector for this specific class.
Assume a stolen API key will be used, not sold quietly. The distillation campaigns above are what stolen keys get spent on, and they run to nine figures of prompts.
Rotate the credentials your assistant holds on the same schedule you would rotate a production secret, because that is now what they are.
The honest summary
The report is not saying AI has created a new kind of attack. It is saying the cost of attempting one has collapsed, and that the tooling developers adopted in the last two years arrived with trust boundaries nobody drew.
Both of those were predictable. The six-hour figure is the one to remember, because every defensive control you have is implicitly priced against how long an attacker needs, and that price just changed.
Sources. From prompting to autonomy: the evolution of adversarial AI, Google Threat Intelligence Group, 8 September 2026, which is the source for every quote, actor name and figure above. Related here: prompt injection, explained, MCP went stateless and left the tool descriptions alone, and an AI agent that tried to cheat its exam.