Skip to content
Google GTIG Reports Shift in AI Misuse by Cyber Adversaries

Google GTIG Reports Shift in AI Misuse by Cyber Adversaries

First seen 5 Nov 2025, 17:08 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

The Google Threat Intelligence Group (GTIG) has identified a new operational phase of AI abuse, where adversaries are deploying AI-enabled malware in live operations. This shift indicates that threat actors are moving beyond using AI solely for productivity gains to utilizing it for malware execution and social engineering. The report highlights activity from bad actors affiliated with countries such as China, North Korea, Russia, and Iran.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 225d ago How this analysis works

More articles in this cluster (3)

Following this threat?

Track APT28, Promptflux and Amazon Web Services (AWS) in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed