An attacker compromised a cloud resource, planned and built an automated operation, then launched mass credential harvesting in less than six hours. Google Threat Intelligence Group’s September 8 report presents that Q2 2026 case as evidence that adversaries are moving beyond one-off prompts into agentic workflows that scan, recover from errors, and keep an operation moving.
The immediate risk falls on teams running cloud workloads, CI/CD pipelines, code repositories, AI coding assistants, and proprietary models. GTIG also observed attackers stealing AI API credentials, targeting model weights and research, and using victim cloud environments for unauthorized AI workloads. The report spans financially motivated, state-sponsored, and information-operations actors, but it does not publish a total victim count.
Agents compress the attack window
Traditional intrusion response assumes that reconnaissance, tooling, testing, and execution create pauses a defender can exploit. GTIG says agentic orchestration is eroding those pauses. Multi-agent frameworks can manage scanning pipelines, resolve operational errors, and execute credential harvesting at scale while a human remains at a higher level of control.
Google describes the result plainly: “human-in-the-loop latency is dramatically reduced.” In the six-hour campaign, the verified endpoints are a compromised cloud resource and an agent-enabled mass credential-harvesting operation. GTIG says the campaign compromised thousands of third-party credentials. The public report does not name the victim, enumerate every intermediate command, or provide a specific credential count.
That boundary matters. GTIG has observed a faster operational loop, not a universally autonomous attacker. Humans still choose targets and objectives. Automation changes how quickly a workable campaign can be assembled, repaired, and expanded after access is gained.
Figure details
The observed sequence starts with a compromised cloud resource. The attacker uses an agent-enabled workflow to plan and build the campaign. Coordinated agents manage scanning tasks and recover from operational errors, reducing delays that would otherwise require repeated human intervention. The workflow reaches mass credential harvesting in under six hours, compromising thousands of third-party credentials. Google confirms the overall timing and agent-enabled outcome but does not disclose a specific credential count, every command, or the victim's identity.
Development trust carries the payload
The report’s most concrete software-supply-chain evidence centers on UNC6780, also known as TeamPCP. GTIG says the financially motivated actor compromised legitimate developer accounts, published trojanized forks of Model Context Protocol servers such as tiktoken_mcp, and injected malicious code into organizational repositories such as azure-functions-mcp-extension.
DUSTMAKER, the actor’s credential stealer, checks whether it is running in CI/CD. When it finds that environment, GTIG says it extracts OIDC tokens from GitHub Actions runner memory and uses them to publish packages as a trusted publisher. Those packages can carry valid SLSA Build 3 attestations, allowing provenance checks to confirm the compromised identity and build path that actually produced them.
The malware also hides files in the legitimate project directories .claude/, .vscode/, and .cursor/. Malicious configuration can tell an AI assistant to execute a script such as setup.mjs during routine work. In CI/CD, DUSTMAKER creates tasks with names such as Copilot Setup and deletes workflow execution logs from the GitHub interface. Comments at the top of _index.js loaders attempt to manipulate LLM security scanners.
These techniques exploit trusted automation around the model. A valid publisher token, signed attestation, familiar workspace directory, or AI-themed workflow label can all be genuine platform artifacts while the actor controlling them is malicious.
Recognize the automated workflow
Start with identity and execution telemetry around developer systems. Investigate unexpected OIDC-token access from GitHub Actions runners, new trusted-publisher activity, package releases outside the maintainer’s normal workflow, and workflow runs whose logs disappeared without an approved retention action. Correlate those events with changes to AI-related repositories and package-registry accounts.
On developer endpoints and build workers, look inside .claude/, .vscode/, and .cursor/ for recently introduced hooks, startup commands, or configuration that launches unfamiliar scripts. Search for setup.mjs, _index.js, and workflow tasks labeled Copilot Setup, then verify the file origin and process ancestry. These strings are campaign behaviors from GTIG’s report; their presence alone is not proof of compromise.
Cloud defenders should connect that developer telemetry to spikes in scanning, credential-store access, API calls from new principals, and unauthorized high-performance AI workloads. Include proprietary model repositories, prompt stores, research systems, and AI platform API keys in the exposure scope. GTIG observed attackers targeting those assets across healthcare, government, and media as well as stealing compute for LLM use.
Recognition has to cover staged and executed artifacts separately. A malicious package in a cache shows potential exposure. A package-install process, workspace hook, CI/CD task, or child process establishes execution and narrows the identities that need containment.
Break the automation chain
Disable an unexpected publisher, workflow, cloud principal, or AI workload before rotating the credentials it could still read. Revoke CI/CD OIDC sessions and short-lived credentials, then rotate longer-lived cloud, repository, package-registry, and AI platform secrets reachable from the affected runner or workspace. Review recent package versions and attestations against a known maintainer-controlled release path.
Preserve hidden project configuration and workflow history before cleanup. If the GitHub interface lacks a run that other telemetry says occurred, use organization audit, runner, API, and cloud logs to reconstruct the missing interval. Rebuild compromised runners and developer workspaces from a trusted state after retaining the files and process evidence needed to understand propagation.
Google says it combines model safeguards, threat intelligence, malicious-account disruption, and targeted containment through its AI Threat Defense architecture. That is the vendor’s assessment of its own controls. The report does not establish that model-level safety measures alone stop a campaign using stolen cloud and developer identities.
Measure time to containment
Test whether the response path is faster than the operation it must stop. In a controlled exercise, inject an unauthorized CI/CD publisher event, a new AI-themed workflow task, and access to a protected credential from an unfamiliar principal. The expected result is a linked alert, identity disablement, and credential revocation before the six-hour mark, with retained logs that show which automation executed.
Agentic attacks turn waiting time into attacker capacity. A control that detects the right event after the workflow has already harvested credentials is still useful for investigation, but it has lost the contest that GTIG’s new evidence makes visible. Defenders now need to measure the interval from first abnormal identity use to containment as an operational security property.