State-sponsored hackers are leveraging highly advanced tools to speed up their cyberattacks. Threat actors linked to Iran, North Korea, China, and Russia are using AI models such as Google's Gemini to support their operations. According to a new report from Google's Threat Intelligence Group (GTIG), these actors have used AI to create sophisticated phishing campaigns and develop malware.
According to the latest quarterly AI Threat Tracker report, government-backed attackers are increasingly turning to artificial intelligence to support their cyber operations. GTIG's analysis of activity from the final quarter of 2025 found that AI is now being used across several stages of the attack lifecycle, from reconnaissance and social engineering to malware development.
“For government-backed threat actors, large language models have become essential tools for technical research, targeting, and the rapid generation of nuanced phishing lures,” GTIG researchers stated in their report.
Defense Sector Comes Under Reconnaissance Efforts by State-Sponsored Hackers
APT42, an Iranian threat group, has reportedly leveraged Gemini to support its reconnaissance efforts and carry out targeted social engineering campaigns. The group used AI to generate email addresses designed to appear legitimate and associated with specific organizations, while also researching its targets to develop convincing reasons for making contact.
To make its interactions with targets more convincing, APT42 developed realistic personas and scenarios tailored to each engagement. The group also used AI to translate messages and produce natural, native-sounding language, helping it avoid common phishing indicators such as grammatical mistakes and unnatural wording.
UNC2970, a North Korean government-backed threat actor known for targeting the defense sector and posing as corporate recruiters, has also turned to Gemini to research and profile valuable targets. Its reconnaissance efforts involved gathering details about leading cybersecurity and defense firms, identifying specific technical positions, and researching salary ranges.
“This activity blurs the distinction between routine professional research and malicious reconnaissance, as the actor gathers the necessary components to create tailored, high-fidelity phishing personas,” GTIG noted.
AI Model Extraction Attacks Escalate
Google DeepMind and GTIG have also reported a rise in attempts to extract AI models, commonly referred to as “distillation attacks.” These attacks go beyond the misuse of AI operations, instead focusing on obtaining intellectual property from AI models.
More than 100,000 prompts were used in an apparent effort to study and reproduce how Gemini handles reasoning. The prompts covered a broad range of questions and tasks, with many focused on languages other than English, suggesting that the campaign sought to replicate the model's reasoning capabilities across different linguistic contexts.
GTIG did not find evidence of direct attacks against frontier AI models by advanced persistent threat groups. However, the team detected and stopped numerous model extraction attempts carried out worldwide by private-sector organizations and researchers attempting to replicate proprietary model logic.
Real-time detection allowed Google to respond to these attacks immediately, with its security systems putting safeguards in place to protect the model's internal reasoning traces.
AI-Powered Malware Emerges as a New Threat
GTIG identified a malware family known as HONESTCUE that relies on Gemini’s API to provide some of its functions. To make the malware harder to detect, it employs multiple layers of obfuscation that can bypass conventional network-based detection and static analysis.
HONESTCUE uses Gemini’s API as part of its download and execution process, sending prompts to the model and receiving C# source code in return. Its second-stage payload operates without creating files, compiling and running the code directly in memory to avoid leaving traces on the device.
GTIG also uncovered a phishing kit called COINBAIT, which appears to have been developed more quickly with the help of AI-powered coding tools. Designed to steal user credentials, the kit imitates a well-known cryptocurrency exchange and was created using the AI-based platform Lovable AI.
ClickFix Attackers Turn to AI Chat Platforms
Google identified a new social engineering campaign in December 2025 in which threat actors used public sharing features on generative AI platforms such as Gemini, ChatGPT, Copilot, DeepSeek, and Grok. The shared content was designed to appear legitimate while directing users to ATOMIC malware targeting macOS devices.
Attackers used AI models to produce convincing guides for everyday computer tasks, disguising malicious command-line scripts as legitimate solutions. They then shared links to the AI-generated conversations, allowing the attackers to take advantage of trusted domains to deliver the first stage of their attacks.
Stolen API Keys Fuel Underground Market
Demand for AI-powered tools and services remains strong across English- and Russian-speaking underground forums, according to GTIG. Rather than building their own AI models, state-sponsored groups and cybercriminals are turning to established commercial platforms, often accessing them with stolen credentials.
Xanthorox was promoted as a specialized AI toolkit capable of autonomously creating malware and phishing campaigns. However, GTIG found that the tool was not based on a custom-built model. Instead, it relied on multiple commercial AI services, including Gemini, which were accessed using stolen API keys.
Google Takes Action
In response, Google disabled the accounts and assets linked to the threat actors involved. The company also used the intelligence gathered from these incidents to improve its classifiers and AI models, helping them recognize and reject requests related to similar attacks in the future.
“We are committed to developing AI boldly and responsibly, which means taking proactive steps to disrupt malicious activity by disabling the projects and accounts associated with bad actors, while continuously improving our models to make them less susceptible to misuse,” the report stated.
Despite these developments, GTIG noted that neither APT groups nor information operations actors have yet demonstrated breakthrough capabilities capable of fundamentally changing the current threat landscape.
The findings highlight how AI is reshaping cybersecurity, with both attackers and defenders increasingly turning to its capabilities to advance their respective efforts.
The report highlights the need for enterprise security teams to strengthen their defenses against AI-assisted reconnaissance and social engineering, especially across the Asia-Pacific region, where state-backed threat groups from China and North Korea continue to operate.