Adversaries Exploiting Proprietary AI Capabilities, API Traffic to Scale Cyberattacks

GTIG observed a significant increase in threat actors abusing large language models throughout 2025 for reconnaissance, social engineering, malware development, and intellectual-property theft via model extraction. State-linked APTs and criminal groups used LLMs to gather OSINT, craft targeted phishing, automate vulnerability analysis, and generate code for in-memory malware (e.g., HONESTCUE) and phishing kits (e.g., COINBAIT); underground services also resold AI-driven attack tooling, with Google mitigating exposed assets and monitoring repeated probing and exploitation attempts.