AI Agents Steal Thousands of Credentials in 6 Hours

Key Takeaways

• Cybercriminals are leveraging autonomous AI agents to rapidly compromise cloud environments and harvest credentials.
• A recent attack saw a financially motivated actor collect thousands of credentials in less than six hours by deploying an AI-driven workflow.
• These sophisticated AI agents can perform vulnerability scanning, credential exfiltration, error correction, and IP rotation without constant human intervention.
• The attacks highlight a critical shift from manual credential theft to highly automated, self-adapting campaigns, significantly reducing detection and response times.
• Organizations must bolster cloud security, enforce least privilege, and implement robust monitoring for unusual activity to counter this evolving threat.

Cybercriminals are increasingly exploiting autonomous AI agents to transform compromised cloud systems into highly efficient credential-harvesting platforms. In a recent incident, a suspected financially motivated threat actor orchestrated a large-scale operation that planned, built, and executed within six hours, successfully exfiltrating thousands of third-party credentials. This alarming development underscores a growing threat landscape where AI significantly accelerates malicious activities.

This intrusion demonstrates how quickly a breach in a cloud environment can escalate into a widespread identity crisis. Instead of manual execution of each task, the attackers utilized an AI coding chatbot, a specific prompt, and pre-defined instructions. This allowed the system to autonomously scan for weaknesses, gather credentials, troubleshoot issues, and even modify internet-facing addresses while the campaign was active.

Security analysts at Google Cloud identified this activity as part of their broader monitoring of the transition from simple AI prompts to advanced, autonomous adversarial workflows. Google Cloud said in a report that the campaign leveraged the victim’s own cloud environment, enabling its malicious traffic to appear as legitimate internal communications. This tactic drastically shrinks the window available for defenders to detect and mitigate the abuse. Stolen credentials can grant access to critical cloud accounts, development systems, code repositories, and paid AI services. Furthermore, a compromised cloud tenant can provide substantial computing power and a seemingly trusted launchpad for subsequent attacks.

Hackers Deploy Autonomous AI Agents

The attack commenced with the initial compromise of an organization’s cloud infrastructure, followed by the deployment of a sophisticated multi-agent framework. This framework operated using preconfigured Markdown instruction sets, which served as operational playbooks. These instructions guided the system to autonomously handle vulnerability scanning, credential collection, real-time troubleshooting, and IP rotation, minimizing the need for continuous human oversight.

This approach transcends traditional automation. The AI agents demonstrated the ability to react to and resolve problems encountered during the scanning process, ensuring the workflow continued uninterrupted. This adaptability significantly reduces the operational pauses typically required for human operators to review and address failures. Security researchers have consistently highlighted that such adaptive adversarial activities pose a greater challenge to defense mechanisms compared to static malicious programs.

During their investigation, researchers also uncovered an exposed command-and-control server hosting a framework identified as “Recon.” An initial directory listing on this server revealed various agent configuration and knowledge files. Shortly after, the server presented a live dashboard designed for organizing, validating, and managing over 23,800 harvested secrets, including critical API keys for cloud and AI services.

The “Recon dashboard” observed by researchers confirms a highly automated, end-to-end post-compromise pipeline requiring minimal manual intervention once initially configured. This level of autonomy represents a significant advancement in attacker capabilities.

Cloud and Development Systems Under Pressure

This particular campaign signals a crucial shift away from credential stealers that primarily target endpoints. Autonomous agents possess the capability to research exposed vulnerabilities, inspect server-side systems, execute targeted actions, and process large volumes of data at speeds that allow smaller criminal groups to achieve the operational scale of much larger teams.

Development environments are particularly vulnerable, as their associated accounts frequently store valuable tokens and keys. The Google Cloud report also detailed the DUSTMAKER threat, linked to UNC6780 or TeamPCP, which specifically targeted AI development tools and CI/CD systems. A recent vulnerability discovered in GitHub Actions workflows further illustrates how compromised automation can expose OIDC tokens and inject malicious changes downstream into development pipelines.

The broader implications for supply chain security are no longer theoretical. In another incident, an automated GitHub supply chain attack impacted thousands of repositories in a matter of hours. Reports of malicious CI pipeline activity continually emphasize the importance of pinning trusted workflow components to specific, verified revisions to mitigate such risks.

Google stated that it deactivated assets associated with the observed campaigns and enhanced its protective measures following the operational security lapses by the threat actors.

What You Should Do

• Treat all cloud credentials, API keys, and AI tool configurations as highly sensitive secrets.
• Implement and strictly enforce the principle of least privilege across all accounts and services.
• Ensure regular rotation of credentials, especially after any suspected exposure.
• Proactively monitor cloud activity for unusual scanning behaviors, unexpected IP address changes, and large exports of sensitive data.
• Conduct thorough and frequent reviews of all automated workflows for potential vulnerabilities or malicious modifications.
• Immediately investigate any newly exposed services or unusual use of build runners.
• Isolate production cloud projects from development workloads to limit the lateral movement of intruders.
• Develop and regularly rehearse clear incident response playbooks, recognizing that traditional response times measured in hours may be insufficient against rapid, AI-driven attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.