Transparent Tribe’s ‘Vibeware’ Shift Signals Rise of AI-Generated Malware at Industrial Scale

APT36 (Transparent Tribe) has shifted to a high-volume, AI-assisted "vibeware" approach, rapidly producing disposable implants in multiple languages to target Indian government, military personnel, diplomatic missions and other regional organizations. Delivery uses malicious archives with shortcut (.LNK) files leading to fileless PowerShell execution; operators then use cloud-backed C2 channels (Discord, Slack, Google Sheets, Firebase, Google Drive, Supabase) to control implants such as CrystalShell, ZigShell, SheetCreep, and LuminousStealer. The campaign emphasizes quantity over code quality, complicating detection by signature-based defenses and relying on behavioral detection, EDR, and scrutiny of outbound connections to trusted cloud platforms.