ThreatCluster

Gemini AI Misused for Advanced Malware Development by Cybercriminals

First seen 2 Dec 2025, 18:33 UTC • •18

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Nation-state actors and cybercrime organizations are leveraging Gemini AI to create a 'Thinking Robot' malware module capable of self-modification to evade detection. This malware can also develop AI agents for tracking adversaries' behaviors, as reported by the Google Threat Intelligence Group in their latest AI Threat Tracker. The report indicates a significant shift in how attackers are utilizing Gemini, moving beyond mere productivity enhancements.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 196d ago How this analysis works

More articles in this cluster (2)

Threat Graph

13 entities, 30 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Apt28
APT42
Promptlock

Technique (4)

Malware
Phishing
Ransomware
T1566 - Phishing

Malware (2)

Promptflux
Promptsteal

Tool (4)

Gemini
Hugging Face
VBScript
VirusTotal

Relationships

Apt28 uses Promptflux
Apt28 uses Promptsteal
APT42 uses Promptflux
APT42 uses Promptsteal
Promptlock uses Promptflux
Promptlock uses Promptsteal
Apt28 uses Gemini
Apt28 uses Hugging Face
Apt28 uses VBScript
Apt28 uses VirusTotal
APT42 uses Gemini
APT42 uses Hugging Face
APT42 uses VBScript
APT42 uses VirusTotal
Promptlock uses Gemini
Promptlock uses Hugging Face
Promptlock uses VBScript
Promptlock uses VirusTotal
Apt28 uses Malware
Apt28 uses Phishing
Apt28 uses Ransomware
Apt28 uses T1566 - Phishing
APT42 uses Malware
APT42 uses Phishing
APT42 uses Ransomware
APT42 uses T1566 - Phishing
Promptlock uses Malware
Promptlock uses Phishing
Promptlock uses Ransomware
Promptlock uses T1566 - Phishing

Following this threat?

Track Promptlock, Apt28 and Promptflux in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

AI Phishing Threatens School Cybersecurity Schools face increasing risks from AI-driven phishing attacks, including deepfake voice notes and malware like PromptLock that evolves with each execution. With an average of 2,739 edtech tools per district, the reliance on technology makes schools vulnerable to sophisticated scams. Recent surveys indicate that only…

Trellix Reports on Five Evasive Cyber Campaigns in 2026 Trellix's SecondSight Threat Hunting Report details five significant cyber campaigns from the first half of 2026, including APT28 and the Axios npm supply chain attack. Attackers exploited trusted infrastructures and employed advanced evasion techniques, such as using compromised government accounts and weaponizing…