[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAoA9cU2ic3n6WqZb0Ag8d0c4FLQ2J7V9LNDjeiXbFag":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5027f6c3-ec16-42f3-a4ab-78f58405aa43","Hackers build AI frameworks for widescale credential theft","hackers-build-ai-frameworks-for-widescale-credential-theft-6c7e13","Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack. [...]","Threat actors are evolving beyond simple AI coding assistants to sophisticated multi-agent frameworks that automate complex attack stages with minimal human intervention. Google Threat Intelligence Group (GTIG) observed these frameworks coordinating tasks, troubleshooting, and adapting actions, significantly reducing defender response windows. While fully autonomous hacking isn't widespread, these AI-driven tools are being used for credential harvesting, reconnaissance, and even malware development by various threat actors.","Hackers are using AI multi-agent frameworks to automate credential theft and other attack stages.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-build-ai-frameworks-for-widescale-credential-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F27\u002Fbotnet.jpg","2026-09-08T12:03:03+00:00","2026-09-08T14:00:10.161667+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Gemini","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":25},"UNC5792","threat_actor",{"name":27,"type":25},"UNC6780",{"name":29,"type":30},"TeamPCP","campaign","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":31,"icon":33,"name":34,"slug":35},null,"AI Security","ai-security",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":48,"value":56,"context":57},"OpenClaw","Artifacts related to the Recon framework",[21,18],{"controls":60,"vendors":139},[61,90,116],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,100,108],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":96,"product_name":97,"url":98,"description":99},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":117,"name":118,"problem":119,"products":120},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[121,129,134],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":130,"product_name":131,"url":132,"description":133},"cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":135,"product_name":136,"url":137,"description":138},"sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",[140],{"slug":141,"name":21,"logo_path":142,"roles":143},"google","\u002Fvendor-logos\u002Fgoogle.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":162},"ai-powered-multi-agent-frameworks-accelerate-credential-theft-at-scale","AI-Powered Multi-Agent Frameworks Accelerate Credential Theft at Scale","Threat actors are now deploying sophisticated AI multi-agent frameworks that automate credential harvesting, reconnaissance, and malware development with minimal human oversight, drastically compressing the attack lifecycle. This evolution moves beyond opportunistic hacking into coordinated, adaptive campaigns that can outpace traditional defender response times. The core problem is that organizations relying on human-speed detection and response are increasingly outmatched by machine-speed attacks targeting credentials — the keys to virtually every enterprise system. Stolen credentials remain one of the most prevalent initial access vectors, meaning a single compromised account can cascade into a full breach. As AI lowers the skill barrier for attackers, organizations that have not hardened credential management and automated their own defenses face disproportionate risk.",[150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Authenticator Assurance)","NIST AC-2 – Account Management","NIST AC-7 – Unsuccessful Logon Attempts","NIST SI-4 – System Monitoring","NIST IA-5 – Authenticator Management","MITRE ATT&CK T1110 – Brute Force \u002F Credential Access","MITRE ATT&CK T1078 – Valid Accounts","GDPR Article 32 – Security of Processing (where personal data credentials are at risk)",{}]