ThreatCluster

Gemini AI Misused for Advanced Malware Development by Cybercriminals

First seen 2 Dec 2025, 18:33 UTC • •18

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Nation-state actors and cybercrime organizations are leveraging Gemini AI to create a 'Thinking Robot' malware module capable of self-modification to evade detection. This malware can also develop AI agents for tracking adversaries' behaviors, as reported by the Google Threat Intelligence Group in their latest AI Threat Tracker. The report indicates a significant shift in how attackers are utilizing Gemini, moving beyond mere productivity enhancements.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 241d ago How this analysis works

More articles in this cluster (2)

Threat Graph

13 entities, 30 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

APT28
APT42
Promptlock

Technique (4)

Malware
Phishing
Ransomware
T1566 - Phishing

Malware (2)

Promptflux
Promptsteal

Tool (4)

Gemini
Hugging Face
VBScript
VirusTotal

Relationships

APT28 uses Promptflux
APT28 uses Promptsteal
APT42 uses Promptflux
APT42 uses Promptsteal
Promptlock uses Promptflux
Promptlock uses Promptsteal
APT28 uses Gemini
APT28 uses Hugging Face
APT28 uses VBScript
APT28 uses VirusTotal
APT42 uses Gemini
APT42 uses Hugging Face
APT42 uses VBScript
APT42 uses VirusTotal
Promptlock uses Gemini
Promptlock uses Hugging Face
Promptlock uses VBScript
Promptlock uses VirusTotal
APT28 uses Malware
APT28 uses Phishing
APT28 uses Ransomware
APT28 uses T1566 - Phishing
APT42 uses Malware
APT42 uses Phishing
APT42 uses Ransomware
APT42 uses T1566 - Phishing
Promptlock uses Malware
Promptlock uses Phishing
Promptlock uses Ransomware
Promptlock uses T1566 - Phishing

Following this threat?

Track Promptlock, APT28 and Promptflux in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Emerging Threats from Autonomous AI Cyber Crime As organizations adopt AI technologies, the cybersecurity landscape is evolving, with AI-driven attacks becoming more prevalent. Check Point Research reported that 1 in 54 generative AI prompts from enterprise networks poses a high risk of sensitive data exposure, affecting 91% of organizations using AI tools. This…

AI-Driven Phishing Attacks Surge to Over 80% of Global Social Engineering Incidents Phishing attacks utilizing artificial intelligence (AI) now account for over 80% of global social engineering activities, as reported in the ESET SMB Cyber Readiness Index 2026. The rise of sophisticated cybercriminal organizations offering malware-as-a-service (MaaS) has transformed the threat landscape, targeting…