Google Reports State-Backed Hackers Using Gemini AI for Recon and Attack Support

Google Threat Intelligence observed North Korea-linked UNC2970 and multiple other state and criminal actors leveraging the Gemini generative AI model for target profiling, tailored phishing persona creation, and to generate malicious code; researchers identified HONESTCUE (a Gemini-driven downloader that requests C# code from the API and compiles/executes it in memory) and COINBAIT (an AI-built credential-harvesting phishing kit), along with widespread model-extraction and AI-hosted malware delivery campaigns.