Google says hackers are abusing Gemini AI for all attacks stages

Google Threat Intelligence Group reports that state-sponsored and criminal threat actors are leveraging the Gemini LLM to support all attack stages — from OSINT and tailored phishing lure creation to vulnerability testing, code generation, C2 development, and data exfiltration; observed misuse includes APT-linked activity (multiple nation-state groups), AI-assisted malware frameworks (HonestCue, CoinBait) and ClickFix-delivered macOS infostealers (AMOS), plus large-scale model extraction attempts, prompting Google to disable abusive accounts and harden defenses.