Agentic AI Credential Harvesting: An Attack Built in Under Six Hours and the Separate Recon Case

1. Basic Information

• Article Title: GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
• Publisher: Google Threat Intelligence Group
• Publication Date: 2026-09-08
• Original Source: Google Threat Intelligence Group
• Related Sources: BleepingComputer: Hackers build AI frameworks for credential theft
• Related Malware, Groups, CVEs, and Products: Recon framework, OpenClaw artifacts, Cloud infrastructure, AI coding chatbot, Gemini, OpenClaw
• Priority: High

2. Executive Summary

GTIG reported a case in which a multi-agent framework on compromised cloud infrastructure autonomously managed scanning, credential harvesting, error correction, and IP rotation, compromising thousands of third-party credentials in under six hours.

3. Attack Flow

Credential harvesting built and executed in under six hours on compromised cloud resources

1. An attacker compromises an organization’s cloud resources. The specific initial entry path has not been disclosed.
2. Using an AI coding chatbot and Markdown instructions, the attacker builds multi-agent roles and workflows.
3. The agents scan internet-facing services and continuously investigate vulnerabilities, attempt exploitation, and correct errors.
4. Using legitimate IP addresses of the compromised cloud infrastructure, they rotate IPs and harvest third-party credentials at scale.

Separate case: Recon’s exposed C2 and management dashboard

1. GTIG found Recon on an exposed C2, including AGENTS.md, KNOWLEDGE.md, and .openclaw/ artifacts.
2. It later observed an operational dashboard for organizing, validating, and managing more than 23,800 collected secrets. This does not establish that every secret was valid or that follow-on compromises succeeded.

4. Attacker Position and Execution Environment

• An attacker already inside victim cloud infrastructure and able to manipulate compute resources, networking, and credentials.
• An operator able to build and direct an agentic framework.

5. What Users and Administrators May See

Users

• Direct user interaction is not central to this activity. Third-party services may see rapid scanning or logins from legitimate cloud IP addresses.

Administrators

• Inference: Compromised cloud environments may show many outbound connections and suspicious workloads, while third parties see requests from legitimate cloud IP addresses.

6. Success Conditions and Risk Reduction

Success Conditions

• The attacker has access to cloud resources and AI tools.
• The attacker can provide agents with tasks, tools, network access, and credential access.
• Rate limits and egress controls do not stop rapid parallel scanning and secret validation.

Failure Conditions and Risk Reduction

• Assign dedicated, short-lived identities to cloud workloads and restrict the scope, lifetime, and allowed origins of secrets.
• Allowlist agent egress and limit scanning rates, concurrency, tool privileges, and budgets.
• Correlate large-scale scanning, secret validation, new workloads, and IP rotation across cloud, IdP, and API records, and maintain a means to stop activity immediately.

7. Potential Impact

• Thousands of third-party credentials were compromised in the cloud-abuse case. In the separate Recon case, a dashboard managing more than 23,800 collected secrets was observed.
• Detection evasion using the reputation and legitimate IP addresses of compromised cloud infrastructure.
• Follow-on access to cloud or AI services, resource theft, and data theft.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

• Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records.
• Proxy/SWG/DNS: Check large numbers of scan destinations, API connections, and name-resolution requests. Inspecting traffic contents requires conditions such as TLS inspection.
• Endpoint/EDR: Investigate suspicious running processes and agent configuration on compromised hosts. Filenames such as AGENTS.md alone do not establish maliciousness.
• Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval.
• SaaS/Cloud: Use cloud audit and usage records to examine workload creation, secret access, changes to IP allocation, and AI API usage.
• Network: Use network flows to investigate connections to numerous destinations and outbound volumes, and correlate source-IP changes with cloud audit records.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations.

• Attempt observed (success unconfirmed): Evidence criterion: Confirm abnormal scanning from cloud infrastructure or large numbers of requests to third-party services.
• User interaction confirmed: Evidence criterion: User interaction is generally not required.
• Initial execution confirmed: Evidence criterion: Confirm execution of the agent framework, its instructions, or automation processes.
• Malware execution or authentication success confirmed: Evidence criterion: Confirm successful validation of third-party credentials or successful cloud/AI-service logins.
• Data theft or session compromise confirmed: Evidence criterion: Confirm storage and classification in a secrets database, or exfiltration.
• Follow-on compromise confirmed: Evidence criterion: Confirm compromise of another service using obtained credentials or unauthorized workloads.

10. Investigation Playbook

Inference: Operational recommendations based on publicly described behavior.

• Trigger: Large-scale scanning, suspicious workload creation, or a spike in secret access.
• Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure.
• Endpoint: Investigate suspicious running processes and agent configuration on compromised hosts. Filenames such as AGENTS.md alone do not establish maliciousness.
• Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. Use cloud audit and usage records to examine workload creation, secret access, changes to IP allocation, and AI API usage.
• Follow-on Activity: Use network flows to investigate connections to numerous destinations and outbound volumes, and correlate source-IP changes with cloud audit records.
• Containment: Stop suspicious workloads and egress, and preserve relevant logs. Revoke and replace compromised cloud identities and secrets, and assess the scope of attacks against third parties.
• Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations.

11. Defense and Detection Ideas

Inference: Operational recommendations based on publicly described behavior.

• Single Event: Large-scale scanning, suspicious workload creation, or a spike in secret access.
• Time-Series Correlation: Correlate workload creation, configuration files, the start of scanning, IP changes, and credential-validation traffic. Keep Recon separate from the under-six-hour case.
• Threat Hunting: Check large numbers of scan destinations, API connections, and name-resolution requests. Inspecting traffic contents requires conditions such as TLS inspection. Use network flows to investigate connections to numerous destinations and outbound volumes, and correlate source-IP changes with cloud audit records.
• Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise.
• Priority Controls: Assign dedicated, short-lived identities to cloud workloads and restrict the scope, lifetime, and allowed origins of secrets.

12. Facts / Inference / Hypothesis

Facts

• In the second quarter of 2026, GTIG observed an attacker design, build, and execute a large-scale agentic credential-harvesting campaign in under six hours using compromised cloud resources.
• AI agents used Markdown instructions as playbooks to manage vulnerability scanning, real-time troubleshooting, IP rotation, and credential harvesting with minimal human intervention.
• Attack traffic originated from legitimate IP addresses of the victim’s cloud infrastructure, and thousands of third-party credentials were compromised.
• In a separate case, Recon configuration files were exposed on a C2, followed by an operational dashboard for organizing, validating, and managing more than 23,800 collected secrets. Successful validation of every secret and the results of subsequent use were not established.
• GTIG has not observed widespread fully autonomous zero-day discovery and exploitation of real-world networks. Google disabled associated assets and updated model-side mitigations.

Inference

• The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

• T1588.007 Obtain Capabilities: Artificial Intelligence (high confidence): AI coding tools and multi-agent frameworks automate attacks.
• T1595 Active Scanning (high confidence): Agents autonomously manage vulnerability-scanning workflows.
• T1528 Steal Application Access Token (high confidence): Application secrets such as API keys are harvested at scale.
• T1090 Proxy (medium confidence): Legitimate cloud IP addresses and IP rotation distribute traffic sources.

14. Unknowns and Further Investigation

• The initial cloud entry path, victim industries, and specific exploitation targets.
• The validity periods and subsequent use of compromised third-party credentials.
• The proportion of decisions made autonomously by agents and details of operator intervention.

15. Impact on SOCs and Organizations

Because compromised cloud infrastructure can be repurposed to attack third parties, correlate egress, large-scale scanning, secret access, and workload creation. Limit the privileges and budgets of organization-managed agents while applying cloud-side network controls and shutdown capabilities to systems introduced by intruders. The observed under-six-hour build-and-execution window highlights the need to prepare for rapid containment.

16. Audience Summaries

• SOC: Correlate workload creation, configuration files, the start of scanning, IP changes, and credential-validation traffic. Keep Recon separate from the under-six-hour case.
• Administrators: Assign dedicated, short-lived identities to cloud workloads and restrict the scope, lifetime, and allowed origins of secrets.
• Users: Direct user interaction is not central to this activity. Third-party services may see rapid scanning or logins from legitimate cloud IP addresses.