AI both target and tool: Recorded Future documents rising AI‑enabled supply‑chain, phishing, and agentic attacks
Recorded Future’s Insikt Group reports that AI is increasingly both a target and a force multiplier for cybercriminals and state actors, based on 103 AI‑enabled incidents between July 31, 2025 and July 31, 2026. Most incidents accelerated familiar attack types — supply‑chain compromise, phishing, extortion, credential theft and data exfiltration — rather than introducing novel AI‑specific exploits, though agentic operations with limited human oversight have been observed. Developer tools and AI proxies are a primary target because of privileged access to code, credentials, and pipelines; Recorded Future documents multiple supply‑chain compromises that inserted credential‑theft and persistence code into developer packages. The report also documents targeted use of AI agents (one campaign against Taiwanese government entities reportedly used up to eight agents) and warns that fully autonomous attacks remain rare today but will likely grow as agentic techniques and illicit access to commercial models diffuse.
Detalhes técnicos
- Dataset: Insikt Group identified 103 documented incidents that used AI as a vector, tool, or target; 32 incidents involved AI in malware or offensive operations and were categorized with Recorded Future’s AI Malware Maturity Model (AIM3), while 71 incidents represented AI-as-lure, AI-targeting, AI-assisted deception, or abuse of AI services. (recordedfuture.com)
- Supply‑chain and developer tool compromises: Multiple incidents (Feb, Apr, May 2026 timeframe cited) involved compromised AI proxy or developer packages that delivered credential theft, lateral movement, and backdoor persistence; the May activity also references the Shai‑Hulud supply‑chain worm targeting Claude Code. (recordedfuture.com)
- Phishing and influence: Phishing kits and SEO poisoning increasingly incorporate LLMs to generate personalized lures; a cited operation targeted French pensioners with automated, highly tailored messages. (recordedfuture.com)
- State activity and agentic operations: Most state‑sponsored use of AI sits at AIM3 Level 2–3 (AI‑assisted development/optimization), with evidence of LLM use in malware code and an outlier campaign against Taiwanese government entities that reportedly used up to eight AI agents with limited human intervention. (recordedfuture.com)
- Ransomware and extortion: Groups such as The Gentlemen are using LLMs to accelerate the time from compromise to extortion and to triage exfiltrated data for tailored ransom demands. (recordedfuture.com)
- Tooling and ecosystem risks: Release of advanced models (e.g., Anthropic’s Mythos) and open‑weight models is correlated with increased interest in automated vulnerability discovery and a rise in NVD submissions; illicit access to commercial models is becoming a criminal market. (recordedfuture.com)
Remediação
- Limit AI agents’ privileges and separate them from sensitive systems; require explicit human approval for consequential actions and maintain independent monitoring and kill switches. (recordedfuture.com)
- Audit third‑party AI dependencies, code‑generation plugins, proxy packages, and open‑weight model repositories for malicious code, command injection, or backdoors. (recordedfuture.com)
- Monitor infostealer telemetry and dark‑web markets for compromised AI model subscriptions, developer API keys, and OAuth tokens; rotate credentials and revoke exposed tokens promptly. (recordedfuture.com)
- Reassess risk profiles and third‑party contractual duties, prepare incident playbooks for supply‑chain compromises, and plan for compressed extortion timelines and rapid triage of exfiltrated datasets. (recordedfuture.com)
Linha do tempo
-
AI both target and tool: Recorded Future documents rising AI‑enabled supply‑chain, phishing, and agentic attacks
ler a análise desta fonte ocultar
Recorded Future’s Insikt Group reports that AI is increasingly both a target and a force multiplier for cybercriminals and state actors, based on 103 AI‑enabled incidents between July 31, 2025 and July 31, 2026. Most incidents accelerated familiar attack types — supply‑chain compromise, phishing, extortion, credential theft and data exfiltration — rather than introducing novel AI‑specific exploits, though agentic operations with limited human oversight have been observed. Developer tools and AI proxies are a primary target because of privileged access to code, credentials, and pipelines; Recorded Future documents multiple supply‑chain compromises that inserted credential‑theft and persistence code into developer packages. The report also documents targeted use of AI agents (one campaign against Taiwanese government entities reportedly used up to eight agents) and warns that fully autonomous attacks remain rare today but will likely grow as agentic techniques and illicit access to commercial models diffuse.
Technical Details
- Dataset: Insikt Group identified 103 documented incidents that used AI as a vector, tool, or target; 32 incidents involved AI in malware or offensive operations and were categorized with Recorded Future’s AI Malware Maturity Model (AIM3), while 71 incidents represented AI-as-lure, AI-targeting, AI-assisted deception, or abuse of AI services. (recordedfuture.com)
- Supply‑chain and developer tool compromises: Multiple incidents (Feb, Apr, May 2026 timeframe cited) involved compromised AI proxy or developer packages that delivered credential theft, lateral movement, and backdoor persistence; the May activity also references the Shai‑Hulud supply‑chain worm targeting Claude Code. (recordedfuture.com)
- Phishing and influence: Phishing kits and SEO poisoning increasingly incorporate LLMs to generate personalized lures; a cited operation targeted French pensioners with automated, highly tailored messages. (recordedfuture.com)
- State activity and agentic operations: Most state‑sponsored use of AI sits at AIM3 Level 2–3 (AI‑assisted development/optimization), with evidence of LLM use in malware code and an outlier campaign against Taiwanese government entities that reportedly used up to eight AI agents with limited human intervention. (recordedfuture.com)
- Ransomware and extortion: Groups such as The Gentlemen are using LLMs to accelerate the time from compromise to extortion and to triage exfiltrated data for tailored ransom demands. (recordedfuture.com)
- Tooling and ecosystem risks: Release of advanced models (e.g., Anthropic’s Mythos) and open‑weight models is correlated with increased interest in automated vulnerability discovery and a rise in NVD submissions; illicit access to commercial models is becoming a criminal market. (recordedfuture.com)
Remediation
- Limit AI agents’ privileges and separate them from sensitive systems; require explicit human approval for consequential actions and maintain independent monitoring and kill switches. (recordedfuture.com)
- Audit third‑party AI dependencies, code‑generation plugins, proxy packages, and open‑weight model repositories for malicious code, command injection, or backdoors. (recordedfuture.com)
- Monitor infostealer telemetry and dark‑web markets for compromised AI model subscriptions, developer API keys, and OAuth tokens; rotate credentials and revoke exposed tokens promptly. (recordedfuture.com)
- Reassess risk profiles and third‑party contractual duties, prepare incident playbooks for supply‑chain compromises, and plan for compressed extortion timelines and rapid triage of exfiltrated datasets. (recordedfuture.com)