Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation

Google disclosed an active mass vulnerability exploitation campaign in which an unknown cybercrime actor used a zero-day Python-based exploit—showing hallmarks of LLM-generated code—to bypass two-factor authentication in a widely used open-source web administration tool; Google worked with the vendor to remediate the flaw. The report also details PromptSpy, an Android backdoor that abuses Gemini for autonomous interface navigation, biometric capture/replay, resilient C2 updates, and anti-uninstallation measures, and highlights multiple APT and criminal groups leveraging AI/LLMs, shadow API relay markets, and agentic tools to scale vulnerability discovery, exploit development, and supply-chain style attacks.