Nation-State Hackers Embrace Gemini AI for Malicious Campaigns, Google Finds

Google Threat Intelligence Group and DeepMind reported that government-backed APTs (Iranian, Chinese, North Korean) and criminal groups increasingly use generative AI for reconnaissance, phishing, vulnerability research, and post-compromise actions; financially motivated actors are performing model extraction and offering jailbroken AI services on underground markets, and researchers observed AI-enabled malware (Honestcue) using a commercial LLM API to generate and execute malicious code in memory.