cloud.google.com State-Sponsored Hackers Exploit Google's Gemini AI for Cyberattacks
Article Content
Browse articles 
State-backed hackers from China, Iran, North Korea, and Russia are utilizing Google's Gemini AI model to facilitate various stages of cyberattacks, including reconnaissance and post-compromise actions. Notably, the Chinese group APT31 has employed Gemini to analyze vulnerabilities and plan attacks against U.S. organizations, although no successful breaches have been reported.
Ask AI about this cluster
Answers cite the sources they use
Updated 204d ago How this analysis works
Timeline
2026-02-12
Google reports state-backed hackers using Gemini AI for attacks
2026-02-12
APT31 identified as using Gemini for planning cyberattacks against US
More articles in this cluster (162)
Following this threat?
Track APT31, ClickFix and Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
New ChainScript RAT Exploits ClickFix Lures with Blockchain C2 A newly discovered Node.js remote access trojan (RAT) named ChainScript is being deployed through ClickFix social engineering tactics, targeting Windows systems. The malware utilizes a unique command-and-control (C2) discovery method by querying a Polygon blockchain smart contract to dynamically rotate its server… 
Cybercriminals Exploit ChatGPT Custom GPTs for ClickFix RAT Attacks A new ClickFix campaign has been discovered that exploits ChatGPT Custom GPTs to impersonate legitimate products, luring users into executing malicious code. Cybersecurity firm Huntress reported that at least 40 users have been infected, with two confirmed incidents linked to Custom GPT instances. The attackers…