Nation-State Threat Actors Incorporate AI to Streamline Attacks

Google Threat Intelligence Group (GTIG) reports that nation-state actors have integrated large language models (such as Gemini) and other generative AI into their operations to automate reconnaissance, create culturally nuanced, hyper-personalized and multi-turn phishing lures, and abuse public sharing features of AI services to host ClickFix social engineering content that tricks users into pasting malicious commands; GTIG observed this campaign in early December 2025 and noted adversaries bypassing safety guardrails.