# AI Threat Watch

> A world map and verified case files of publicly reported AI security incidents: attacks on AI systems (prompt injection, model and data leaks, AI supply chain, agent hijacks) and attacks carried out with AI (deepfake fraud, AI-assisted malware, AI phishing, state operations). A live wire of AI security news from vetted sources is refreshed every 30 minutes; verified case files are researched separately and carry a permanent link, primary sources and a citation. Case files are available in English, French, Spanish, Arabic and Chinese. All data is open under CC BY 4.0.

Positioning: a reference registry of AI security incidents (attacks on AI systems, and attacks carried out with AI): structured, verified, fast, multilingual and openly licensed.

## Key pages
- [All verified case files](https://aithreat.io/cases/): 295 incidents, newest first, with hubs by type and country
- [Interactive world map](https://aithreat.io/): the same cases on a map with filters
- [Live wire](https://aithreat.io/#wire): AI security headlines from vetted sources, refreshed every 30 minutes (machine-triaged, not verified)
- [Market reaction](https://aithreat.io/#markets): share-price moves of listed companies after incidents (methodology on the page)
- [Data and citing](https://aithreat.io/#data): download links, field list, inclusion rule, severity scale
- [About and method](https://aithreat.io/about/): inclusion rule, severity scale, verified case files versus the machine-triaged wire, CC BY 4.0 licence and citation format, corrections policy (public change log, no silent edits), contact
- [Glossary of incident types](https://aithreat.io/cases/glossary/): plain-language definitions of the nine categories, each linked to its cases
- Company hubs: https://aithreat.io/cases/company/<slug>/ lists the cases in which one company or product was the target (see the list below)

## Open data
- [incidents.en.json](https://aithreat.io/data/incidents.en.json): the full verified dataset (fields: id, date, title, category, direction, severity, country, region, target, loss_usd, summary, actor, actor_type, attribution, motive, vector, root_cause, timeline, impact, response, status, cve, sources)
- [Verified case files RSS](https://aithreat.io/cases/feed.xml)
- [Live wire RSS](https://aithreat.io/feed.xml)
- [Sitemap](https://aithreat.io/sitemap.xml)

## Case files by type
- [AI phishing](https://aithreat.io/cases/category/ai-phishing/): 12 cases
- [AI supply chain](https://aithreat.io/cases/category/ai-supply-chain/): 36 cases
- [AI-assisted malware](https://aithreat.io/cases/category/ai-assisted-malware/): 33 cases
- [Agent hijack](https://aithreat.io/cases/category/agent-hijack/): 21 cases
- [Deepfake fraud](https://aithreat.io/cases/category/deepfake-fraud/): 88 cases
- [LLMjacking](https://aithreat.io/cases/category/llmjacking/): 13 cases
- [Model & data leak](https://aithreat.io/cases/category/model-data-leak/): 40 cases
- [Prompt injection](https://aithreat.io/cases/category/prompt-injection/): 24 cases
- [State actor AI ops](https://aithreat.io/cases/category/state-actor-ai-ops/): 28 cases

## Case files by company
- [17 victims incl. US and Australian healthcare, UK industry](https://aithreat.io/cases/company/17-victims-incl-us-and-australian-healthcare-uk-industry/): 1 case
- [208 investors worldwide](https://aithreat.io/cases/company/208-investors-worldwide/): 1 case
- [300+ organizations' developers](https://aithreat.io/cases/company/300-organizations-developers/): 1 case
- [85+ organisations listed on FunkSec leak site](https://aithreat.io/cases/company/85-organisations-listed-on-funksec-leak-site/): 1 case
- [Aadhaar holders, DigiLocker and digital lenders](https://aithreat.io/cases/company/aadhaar-holders-digilocker-and-digital-lenders/): 1 case
- [ABN Amro and prospective tenants](https://aithreat.io/cases/company/abn-amro-and-prospective-tenants/): 1 case
- [About 50 organisations across six sectors worldwide](https://aithreat.io/cases/company/about-50-organisations-across-six-sectors-worldwide/): 1 case
- [AI vendors' evaluation sandboxes and API keys](https://aithreat.io/cases/company/ai-vendors-evaluation-sandboxes-and-api-keys/): 1 case
- [Amazon Q Developer extension](https://aithreat.io/cases/company/amazon-q-developer-extension/): 1 case
- [An organisation in Southeast Asia](https://aithreat.io/cases/company/an-organisation-in-southeast-asia/): 1 case
- [Android users; Hugging Face CDN](https://aithreat.io/cases/company/android-users-hugging-face-cdn/): 1 case
- [Android users outside Google Play](https://aithreat.io/cases/company/android-users-outside-google-play/): 1 case
- [Anthropic Claude](https://aithreat.io/cases/company/anthropic-claude/): 1 case
- [Anthropic Claude and MiMo end users' data](https://aithreat.io/cases/company/anthropic-claude-and-mimo-end-users-data/): 1 case
- [Anthropic Claude Code (before 2.1.64)](https://aithreat.io/cases/company/anthropic-claude-code-before-2-1-64/): 1 case
- [Anthropic Claude Code CLI](https://aithreat.io/cases/company/anthropic-claude-code-cli/): 1 case
- [Anthropic Claude Code / developers](https://aithreat.io/cases/company/anthropic-claude-code-developers/): 1 case
- [Anthropic Claude Mythos Preview](https://aithreat.io/cases/company/anthropic-claude-mythos-preview/): 1 case
- [Anthropic Claude Opus 4.6 and 4.7 reasoning outputs](https://aithreat.io/cases/company/anthropic-claude-opus-4-6-and-4-7-reasoning-outputs/): 1 case
- [Anthropic mcp-server-git](https://aithreat.io/cases/company/anthropic-mcp-server-git/): 1 case
- [Antigravity IDE user](https://aithreat.io/cases/company/antigravity-ide-user/): 1 case
- [Apps generated by the Lovable AI app builder](https://aithreat.io/cases/company/apps-generated-by-the-lovable-ai-app-builder/): 1 case
- [Apps generated with Lovable AI app builder](https://aithreat.io/cases/company/apps-generated-with-lovable-ai-app-builder/): 1 case
- [Argentine Facebook users; YPF and spokesman Manuel Adorni](https://aithreat.io/cases/company/argentine-facebook-users-ypf-and-spokesman-manuel-adorni/): 1 case
- [Argentine social media users](https://aithreat.io/cases/company/argentine-social-media-users/): 1 case
- [Asana customers using the MCP server](https://aithreat.io/cases/company/asana-customers-using-the-mcp-server/): 1 case
- [Asana MCP server customers](https://aithreat.io/cases/company/asana-mcp-server-customers/): 1 case
- [Australian retail investors](https://aithreat.io/cases/company/australian-retail-investors/): 1 case
- [Aviation, defence, telecom and government in US and Mideast](https://aithreat.io/cases/company/aviation-defence-telecom-and-government-in-us-and-mideast/): 1 case
- [AWS accounts of organizations publishing to Hugging Face and code hosts](https://aithreat.io/cases/company/aws-accounts-of-organizations-publishing-to-hugging-face-and-code-hosts/): 1 case
- [Banco de Credito del Peru customers](https://aithreat.io/cases/company/banco-de-credito-del-peru-customers/): 1 case
- [Bangladeshi online shoppers](https://aithreat.io/cases/company/bangladeshi-online-shoppers/): 1 case
- [Banks and crypto exchanges' KYC checks](https://aithreat.io/cases/company/banks-and-crypto-exchanges-kyc-checks/): 1 case
- [Base44 (Wix) AI app platform](https://aithreat.io/cases/company/base44-wix-ai-app-platform/): 1 case
- [BerriAI LiteLLM proxy](https://aithreat.io/cases/company/berriai-litellm-proxy/): 1 case
- [Brazilian consumers](https://aithreat.io/cases/company/brazilian-consumers/): 2 cases
- [Businesses targeted by phishing and BEC](https://aithreat.io/cases/company/businesses-targeted-by-phishing-and-bec/): 1 case
- [Buyers' victims via ransomware-as-a-service](https://aithreat.io/cases/company/buyers-victims-via-ransomware-as-a-service/): 1 case
- [ChatGPT Gmail connector](https://aithreat.io/cases/company/chatgpt-gmail-connector/): 1 case
- [Chilean social media users; President Gabriel Boric](https://aithreat.io/cases/company/chilean-social-media-users-president-gabriel-boric/): 1 case
- [Claude Opus 4.8 and another US lab's frontier model](https://aithreat.io/cases/company/claude-opus-4-8-and-another-us-lab-s-frontier-model/): 1 case
- [Cline CLI users](https://aithreat.io/cases/company/cline-cli-users/): 1 case
- [Cloud and AI API account holders (OpenAI, AWS, Azure)](https://aithreat.io/cases/company/cloud-and-ai-api-account-holders-openai-aws-azure/): 1 case
- [Cloud environment of an unnamed organisation](https://aithreat.io/cases/company/cloud-environment-of-an-unnamed-organisation/): 1 case
- [Codeway Chat & Ask AI](https://aithreat.io/cases/company/codeway-chat-ask-ai/): 1 case
- [Colombian social media users; Mayor Federico Gutierrez](https://aithreat.io/cases/company/colombian-social-media-users-mayor-federico-gutierrez/): 1 case
- [ComfyUI image-generation servers; Rubick.ai platform](https://aithreat.io/cases/company/comfyui-image-generation-servers-rubick-ai-platform/): 1 case
- [Compromised cloud tenant and its third-party credentials](https://aithreat.io/cases/company/compromised-cloud-tenant-and-its-third-party-credentials/): 1 case
- [Compromised systems in the actor's intrusion campaign](https://aithreat.io/cases/company/compromised-systems-in-the-actor-s-intrusion-campaign/): 1 case
- [Consumers in Brazil's Federal District; Marcos Mion](https://aithreat.io/cases/company/consumers-in-brazil-s-federal-district-marcos-mion/): 1 case
- [Copilot Studio, Salesforce Agentforce](https://aithreat.io/cases/company/copilot-studio-salesforce-agentforce/): 1 case
- [Corporate cloud tenants](https://aithreat.io/cases/company/corporate-cloud-tenants/): 1 case
- [Cryptocurrency and intrusion targets of North Korean groups](https://aithreat.io/cases/company/cryptocurrency-and-intrusion-targets-of-north-korean-groups/): 1 case
- [Cryptocurrency exchange customers](https://aithreat.io/cases/company/cryptocurrency-exchange-customers/): 1 case
- [Cursor AI code editor](https://aithreat.io/cases/company/cursor-ai-code-editor/): 1 case
- [Cursor AI code editor (2.x)](https://aithreat.io/cases/company/cursor-ai-code-editor-2-x/): 1 case
- [Cursor AI editor users on macOS](https://aithreat.io/cases/company/cursor-ai-editor-users-on-macos/): 1 case
- [Cursor IDE users installing Solidity extensions](https://aithreat.io/cases/company/cursor-ide-users-installing-solidity-extensions/): 1 case
- [Customers buying discounted Claude access](https://aithreat.io/cases/company/customers-buying-discounted-claude-access/): 1 case
- [Dating-app users in Taiwan, Singapore, Malaysia and the US](https://aithreat.io/cases/company/dating-app-users-in-taiwan-singapore-malaysia-and-the-us/): 1 case
- [DeepSeek](https://aithreat.io/cases/company/deepseek/): 1 case
- [DeepSeek chat and API services](https://aithreat.io/cases/company/deepseek-chat-and-api-services/): 1 case
- [Developers and crypto firms targeted by DPRK lures](https://aithreat.io/cases/company/developers-and-crypto-firms-targeted-by-dprk-lures/): 1 case
- [Developers installing MCP servers via npx](https://aithreat.io/cases/company/developers-installing-mcp-servers-via-npx/): 1 case
- [Developers integrating the DeepSeek API](https://aithreat.io/cases/company/developers-integrating-the-deepseek-api/): 1 case
- [Developers running Ray AI compute clusters](https://aithreat.io/cases/company/developers-running-ray-ai-compute-clusters/): 1 case
- [Developers using Alibaba Cloud AI Labs services](https://aithreat.io/cases/company/developers-using-alibaba-cloud-ai-labs-services/): 1 case
- [Developers using JetBrains IDE AI assistant plugins](https://aithreat.io/cases/company/developers-using-jetbrains-ide-ai-assistant-plugins/): 1 case
- [Developers using the @mastra AI agent framework](https://aithreat.io/cases/company/developers-using-the-mastra-ai-agent-framework/): 1 case
- [Developers with GitHub and npm tokens](https://aithreat.io/cases/company/developers-with-github-and-npm-tokens/): 1 case
- [Digital yuan app users in mainland China](https://aithreat.io/cases/company/digital-yuan-app-users-in-mainland-china/): 1 case
- [Dr. Marie Faith Sagun-Villarta, Pampanga](https://aithreat.io/cases/company/dr-marie-faith-sagun-villarta-pampanga/): 1 case
- [Dutch banks and rental applicants](https://aithreat.io/cases/company/dutch-banks-and-rental-applicants/): 1 case
- [Elderly residents of Attica](https://aithreat.io/cases/company/elderly-residents-of-attica/): 1 case
- [Elderly Tokyo residents](https://aithreat.io/cases/company/elderly-tokyo-residents/): 1 case
- [Embedded devices, TP-Link firmware and OFTP implementations](https://aithreat.io/cases/company/embedded-devices-tp-link-firmware-and-oftp-implementations/): 1 case
- [Enterprise email users](https://aithreat.io/cases/company/enterprise-email-users/): 1 case
- [European political parties, media, think tanks, SaaS firms](https://aithreat.io/cases/company/european-political-parties-media-think-tanks-saas-firms/): 1 case
- [Exposed LiteLLM, Ollama, Gotenberg and Gitea servers](https://aithreat.io/cases/company/exposed-litellm-ollama-gotenberg-and-gitea-servers/): 1 case
- [Exposed Ollama servers](https://aithreat.io/cases/company/exposed-ollama-servers/): 1 case
- [Exposed Ollama, vLLM and MCP endpoints](https://aithreat.io/cases/company/exposed-ollama-vllm-and-mcp-endpoints/): 1 case
- [Exposed Open WebUI instances](https://aithreat.io/cases/company/exposed-open-webui-instances/): 1 case
- [Fintech and crypto companies](https://aithreat.io/cases/company/fintech-and-crypto-companies/): 1 case
- [Flowise AI agent builder](https://aithreat.io/cases/company/flowise-ai-agent-builder/): 1 case
- [French public and private entities](https://aithreat.io/cases/company/french-public-and-private-entities/): 1 case
- [French savers over 50 and companies](https://aithreat.io/cases/company/french-savers-over-50-and-companies/): 1 case
- [Frontier model providers' account and billing controls](https://aithreat.io/cases/company/frontier-model-providers-account-and-billing-controls/): 1 case
- [Gamers downloading a trojanized gaming tool](https://aithreat.io/cases/company/gamers-downloading-a-trojanized-gaming-tool/): 1 case
- [German Bundestag election candidates and voters](https://aithreat.io/cases/company/german-bundestag-election-candidates-and-voters/): 1 case
- [Ghanaian social media users](https://aithreat.io/cases/company/ghanaian-social-media-users/): 1 case
- [GitHub Copilot Chat](https://aithreat.io/cases/company/github-copilot-chat/): 1 case
- [GitHub Copilot in Visual Studio and VS Code](https://aithreat.io/cases/company/github-copilot-in-visual-studio-and-vs-code/): 1 case
- [GitLab Duo AI assistant](https://aithreat.io/cases/company/gitlab-duo-ai-assistant/): 1 case
- [Google Cloud Vertex AI Agent Engine](https://aithreat.io/cases/company/google-cloud-vertex-ai-agent-engine/): 1 case
- [Google Gemini assistant and Google Home integrations](https://aithreat.io/cases/company/google-gemini-assistant-and-google-home-integrations/): 1 case
- [Google Gemini CLI](https://aithreat.io/cases/company/google-gemini-cli/): 1 case
- [Google Gemini (Cloud Assist, Search, Browsing Tool)](https://aithreat.io/cases/company/google-gemini-cloud-assist-search-browsing-tool/): 1 case
- [Google Gemini Enterprise and Vertex AI Search](https://aithreat.io/cases/company/google-gemini-enterprise-and-vertex-ai-search/): 1 case
- [Google Gemini for Workspace (Gmail summaries)](https://aithreat.io/cases/company/google-gemini-for-workspace-gmail-summaries/): 1 case
- [Google Gemini / multiple sectors](https://aithreat.io/cases/company/google-gemini-multiple-sectors/): 1 case
- [Government bodies in Uzbekistan, Turkmenistan and Kazakhstan](https://aithreat.io/cases/company/government-bodies-in-uzbekistan-turkmenistan-and-kazakhstan/): 1 case
- [Grafana AI assistant](https://aithreat.io/cases/company/grafana-ai-assistant/): 1 case
- [Healthcare, government, emergency services](https://aithreat.io/cases/company/healthcare-government-emergency-services/): 1 case
- [Hugging Face](https://aithreat.io/cases/company/hugging-face/): 1 case
- [Hugging Face Hub users loading PyTorch models](https://aithreat.io/cases/company/hugging-face-hub-users-loading-pytorch-models/): 1 case
- [Hugging Face users downloading OpenAI releases](https://aithreat.io/cases/company/hugging-face-users-downloading-openai-releases/): 1 case
- [Immigrants in Finland](https://aithreat.io/cases/company/immigrants-in-finland/): 1 case
- [Immigrants in Finland; Finnish Police](https://aithreat.io/cases/company/immigrants-in-finland-finnish-police/): 1 case
- [Indian Facebook users; Finance Minister Nirmala Sitharaman](https://aithreat.io/cases/company/indian-facebook-users-finance-minister-nirmala-sitharaman/): 1 case
- [Indian retail investors; impersonated market analysts](https://aithreat.io/cases/company/indian-retail-investors-impersonated-market-analysts/): 1 case
- [Individuals targeted by doxing and remote-access malware](https://aithreat.io/cases/company/individuals-targeted-by-doxing-and-remote-access-malware/): 1 case
- [Indonesian social media users across 20 provinces](https://aithreat.io/cases/company/indonesian-social-media-users-across-20-provinces/): 1 case
- [Indonesian TikTok users; Governor Khofifah Indar Parawansa](https://aithreat.io/cases/company/indonesian-tiktok-users-governor-khofifah-indar-parawansa/): 1 case
- [Internet-exposed Open WebUI deployment](https://aithreat.io/cases/company/internet-exposed-open-webui-deployment/): 1 case
- [Investors in Austria, Germany, Italy, Spain, UK and Canada](https://aithreat.io/cases/company/investors-in-austria-germany-italy-spain-uk-and-canada/): 1 case
- [Iraqi government officials](https://aithreat.io/cases/company/iraqi-government-officials/): 1 case
- [Irish consumers](https://aithreat.io/cases/company/irish-consumers/): 1 case
- [Israeli banks and about 120 identity theft victims](https://aithreat.io/cases/company/israeli-banks-and-about-120-identity-theft-victims/): 1 case
- [Israeli retail investors](https://aithreat.io/cases/company/israeli-retail-investors/): 1 case
- [Italian business executives](https://aithreat.io/cases/company/italian-business-executives/): 1 case
- [Japanese internet users in a teen hacking chat group](https://aithreat.io/cases/company/japanese-internet-users-in-a-teen-hacking-chat-group/): 1 case
- [Japanese residents called from a Kuala Lumpur call centre](https://aithreat.io/cases/company/japanese-residents-called-from-a-kuala-lumpur-call-centre/): 1 case
- [Job seekers in Eastern European countries](https://aithreat.io/cases/company/job-seekers-in-eastern-european-countries/): 1 case
- [Jordanian citizens; impersonated public figures](https://aithreat.io/cases/company/jordanian-citizens-impersonated-public-figures/): 1 case
- [Kenyan crypto buyers](https://aithreat.io/cases/company/kenyan-crypto-buyers/): 1 case
- [Kenyan public; President William Ruto](https://aithreat.io/cases/company/kenyan-public-president-william-ruto/): 1 case
- [Kuwaiti bank customers](https://aithreat.io/cases/company/kuwaiti-bank-customers/): 1 case
- [Langflow AI agent workflow servers](https://aithreat.io/cases/company/langflow-ai-agent-workflow-servers/): 1 case
- [Langflow AI pipeline servers](https://aithreat.io/cases/company/langflow-ai-pipeline-servers/): 1 case
- [Langflow servers](https://aithreat.io/cases/company/langflow-servers/): 1 case
- [Lebanese singer Haifa Wehbe](https://aithreat.io/cases/company/lebanese-singer-haifa-wehbe/): 1 case
- [Lenovo Lena customer support chatbot (GPT-4 based)](https://aithreat.io/cases/company/lenovo-lena-customer-support-chatbot-gpt-4-based/): 1 case
- [Linux cloud environments](https://aithreat.io/cases/company/linux-cloud-environments/): 1 case
- [Linux IoT devices across 17 architectures](https://aithreat.io/cases/company/linux-iot-devices-across-17-architectures/): 1 case
- [LiteLLM proxies before 1.84.0 exposing MCP](https://aithreat.io/cases/company/litellm-proxies-before-1-84-0-exposing-mcp/): 1 case
- [Litigants with pending court cases in Sao Paulo state](https://aithreat.io/cases/company/litigants-with-pending-court-cases-in-sao-paulo-state/): 1 case
- [LLM-based malware analysis pipelines](https://aithreat.io/cases/company/llm-based-malware-analysis-pipelines/): 1 case
- [Lovable projects created before November 2025](https://aithreat.io/cases/company/lovable-projects-created-before-november-2025/): 1 case
- [Malaysian retail investors](https://aithreat.io/cases/company/malaysian-retail-investors/): 1 case
- [Marimo Python notebook servers](https://aithreat.io/cases/company/marimo-python-notebook-servers/): 1 case
- [McDonald's / Paradox.ai](https://aithreat.io/cases/company/mcdonald-s-paradox-ai/): 1 case
- [McKinsey Lilli AI platform](https://aithreat.io/cases/company/mckinsey-lilli-ai-platform/): 1 case
- [Mercor; clients Meta, OpenAI, Anthropic](https://aithreat.io/cases/company/mercor-clients-meta-openai-anthropic/): 1 case
- [Meta AI account-recovery assistant / Instagram](https://aithreat.io/cases/company/meta-ai-account-recovery-assistant-instagram/): 1 case
- [Meta AI app users](https://aithreat.io/cases/company/meta-ai-app-users/): 1 case
- [Meta AI chatbot](https://aithreat.io/cases/company/meta-ai-chatbot/): 1 case
- [Meta internal systems](https://aithreat.io/cases/company/meta-internal-systems/): 1 case
- [Mexican bank customers](https://aithreat.io/cases/company/mexican-bank-customers/): 1 case
- [Mexican Facebook users; President Claudia Sheinbaum](https://aithreat.io/cases/company/mexican-facebook-users-president-claudia-sheinbaum/): 1 case
- [Mexican tax authority, electoral institute, state governments](https://aithreat.io/cases/company/mexican-tax-authority-electoral-institute-state-governments/): 1 case
- [Microsoft 365 Copilot](https://aithreat.io/cases/company/microsoft-365-copilot/): 1 case
- [Microsoft 365 Copilot Chat customers](https://aithreat.io/cases/company/microsoft-365-copilot-chat-customers/): 1 case
- [Microsoft 365 Copilot enterprise customers](https://aithreat.io/cases/company/microsoft-365-copilot-enterprise-customers/): 1 case
- [Microsoft 365 Copilot Enterprise Search](https://aithreat.io/cases/company/microsoft-365-copilot-enterprise-search/): 1 case
- [Microsoft 365 mailboxes and phishing targets](https://aithreat.io/cases/company/microsoft-365-mailboxes-and-phishing-targets/): 1 case
- [Microsoft 365 users, UPS customers, Aave wallet holders](https://aithreat.io/cases/company/microsoft-365-users-ups-customers-aave-wallet-holders/): 1 case
- [Microsoft Azure OpenAI customers](https://aithreat.io/cases/company/microsoft-azure-openai-customers/): 1 case
- [Microsoft Copilot and GitHub repository owners](https://aithreat.io/cases/company/microsoft-copilot-and-github-repository-owners/): 1 case
- [Microsoft Copilot Personal](https://aithreat.io/cases/company/microsoft-copilot-personal/): 1 case
- [MLflow tracking servers 3.3.0 to 3.14.x](https://aithreat.io/cases/company/mlflow-tracking-servers-3-3-0-to-3-14-x/): 1 case
- [Moltbook](https://aithreat.io/cases/company/moltbook/): 1 case
- [More than 320 companies employing remote IT contractors](https://aithreat.io/cases/company/more-than-320-companies-employing-remote-it-contractors/): 1 case
- [MuddyWater phishing victims via compromised corporate email](https://aithreat.io/cases/company/muddywater-phishing-victims-via-compromised-corporate-email/): 1 case
- [Multinational firm (Singapore office)](https://aithreat.io/cases/company/multinational-firm-singapore-office/): 1 case
- [Music streaming platforms and royalty pools](https://aithreat.io/cases/company/music-streaming-platforms-and-royalty-pools/): 1 case
- [New Zealand retail investors](https://aithreat.io/cases/company/new-zealand-retail-investors/): 1 case
- [Nigerian investor Fredrick Amaechi; Peter Obi's likeness](https://aithreat.io/cases/company/nigerian-investor-fredrick-amaechi-peter-obi-s-likeness/): 1 case
- [Nigerian social media users](https://aithreat.io/cases/company/nigerian-social-media-users/): 1 case
- [None confirmed; proof-of-concept or red team tooling](https://aithreat.io/cases/company/none-confirmed-proof-of-concept-or-red-team-tooling/): 1 case
- [Norwegian Tax Administration](https://aithreat.io/cases/company/norwegian-tax-administration/): 1 case
- [Notion AI agents (Notion 3.0)](https://aithreat.io/cases/company/notion-ai-agents-notion-3-0/): 1 case
- [npm/PyPI AI developer packages](https://aithreat.io/cases/company/npm-pypi-ai-developer-packages/): 1 case
- [npm users with Solana wallets](https://aithreat.io/cases/company/npm-users-with-solana-wallets/): 1 case
- [Nx build system users](https://aithreat.io/cases/company/nx-build-system-users/): 1 case
- [Old Mutual customers and South African public](https://aithreat.io/cases/company/old-mutual-customers-and-south-african-public/): 1 case
- [OmniGPT AI chatbot aggregator](https://aithreat.io/cases/company/omnigpt-ai-chatbot-aggregator/): 1 case
- [OmniGPT (multi-model AI chat aggregator)](https://aithreat.io/cases/company/omnigpt-multi-model-ai-chat-aggregator/): 1 case
- [Online fraud victims worldwide](https://aithreat.io/cases/company/online-fraud-victims-worldwide/): 1 case
- [Open-source maintainers on PyPI, npm and Docker Hub](https://aithreat.io/cases/company/open-source-maintainers-on-pypi-npm-and-docker-hub/): 1 case
- [OpenAI API platform users](https://aithreat.io/cases/company/openai-api-platform-users/): 1 case
- [OpenAI ChatGPT code execution runtime](https://aithreat.io/cases/company/openai-chatgpt-code-execution-runtime/): 1 case
- [OpenAI ChatGPT Connectors (Google Drive, SharePoint)](https://aithreat.io/cases/company/openai-chatgpt-connectors-google-drive-sharepoint/): 1 case
- [OpenAI ChatGPT Deep Research agent (Gmail connector)](https://aithreat.io/cases/company/openai-chatgpt-deep-research-agent-gmail-connector/): 1 case
- [OpenAI ChatGPT (GPT-4o and GPT-5)](https://aithreat.io/cases/company/openai-chatgpt-gpt-4o-and-gpt-5/): 1 case
- [OpenAI ChatGPT users](https://aithreat.io/cases/company/openai-chatgpt-users/): 1 case
- [OpenAI Codex users](https://aithreat.io/cases/company/openai-codex-users/): 1 case
- [OpenAI Codex (web, CLI, SDK, IDE extension)](https://aithreat.io/cases/company/openai-codex-web-cli-sdk-ide-extension/): 1 case
- [OpenAI internal source repositories](https://aithreat.io/cases/company/openai-internal-source-repositories/): 1 case
- [OpenAI models (via API)](https://aithreat.io/cases/company/openai-models-via-api/): 1 case
- [OpenClaw agent users](https://aithreat.io/cases/company/openclaw-agent-users/): 1 case
- [OpenClaw users](https://aithreat.io/cases/company/openclaw-users/): 1 case
- [Organisations with vulnerable WordPress servers and Windows](https://aithreat.io/cases/company/organisations-with-vulnerable-wordpress-servers-and-windows/): 1 case
- [Owners of internet-connected security cameras](https://aithreat.io/cases/company/owners-of-internet-connected-security-cameras/): 1 case
- [Pensioner in Mannheim/Heidelberg area](https://aithreat.io/cases/company/pensioner-in-mannheim-heidelberg-area/): 1 case
- [Perplexity Comet AI browser](https://aithreat.io/cases/company/perplexity-comet-ai-browser/): 1 case
- [Perplexity Comet, Copilot in Edge, Gemini in Chrome](https://aithreat.io/cases/company/perplexity-comet-copilot-in-edge-gemini-in-chrome/): 1 case
- [Phishing and credential-theft victims of subscribers](https://aithreat.io/cases/company/phishing-and-credential-theft-victims-of-subscribers/): 1 case
- [Phishing, BEC and ransomware victims of subscribers](https://aithreat.io/cases/company/phishing-bec-and-ransomware-victims-of-subscribers/): 1 case
- [Pindrop Security (hiring process)](https://aithreat.io/cases/company/pindrop-security-hiring-process/): 1 case
- [postmark-mcp users](https://aithreat.io/cases/company/postmark-mcp-users/): 1 case
- [Potential phishing and malware victims worldwide](https://aithreat.io/cases/company/potential-phishing-and-malware-victims-worldwide/): 1 case
- [President Bola Tinubu; Nigerian public discourse](https://aithreat.io/cases/company/president-bola-tinubu-nigerian-public-discourse/): 1 case
- [Private individual (53-year-old interior designer)](https://aithreat.io/cases/company/private-individual-53-year-old-interior-designer/): 1 case
- [Private investor in Lichtenberg, Saxony](https://aithreat.io/cases/company/private-investor-in-lichtenberg-saxony/): 1 case
- [Public administration employees' Exchange and OWA accounts](https://aithreat.io/cases/company/public-administration-employees-exchange-and-owa-accounts/): 1 case
- [PyPI users; two real companies; an internet-facing app](https://aithreat.io/cases/company/pypi-users-two-real-companies-an-internet-facing-app/): 1 case
- [PyTorch Lightning users](https://aithreat.io/cases/company/pytorch-lightning-users/): 1 case
- [QatarEnergy and Qatari public](https://aithreat.io/cases/company/qatarenergy-and-qatari-public/): 1 case
- [QatarEnergy brand and Gulf investors](https://aithreat.io/cases/company/qatarenergy-brand-and-gulf-investors/): 1 case
- [Ray (Anyscale) AI compute clusters](https://aithreat.io/cases/company/ray-anyscale-ai-compute-clusters/): 1 case
- [Retail investors across Europe](https://aithreat.io/cases/company/retail-investors-across-europe/): 1 case
- [Retail investors in the UK and Europe](https://aithreat.io/cases/company/retail-investors-in-the-uk-and-europe/): 1 case
- [Retired couple in Pesaro; Prime Minister Meloni's likeness](https://aithreat.io/cases/company/retired-couple-in-pesaro-prime-minister-meloni-s-likeness/): 1 case
- [Retired engineer in Surrey](https://aithreat.io/cases/company/retired-engineer-in-surrey/): 1 case
- [RubyGems / RubyDoc.info](https://aithreat.io/cases/company/rubygems-rubydoc-info/): 1 case
- [SaaStr production database on Replit](https://aithreat.io/cases/company/saastr-production-database-on-replit/): 1 case
- [SaaStr (Replit Agent user)](https://aithreat.io/cases/company/saastr-replit-agent-user/): 1 case
- [Salesforce Agentforce](https://aithreat.io/cases/company/salesforce-agentforce/): 1 case
- [Salesloft Drift / Salesforce customers](https://aithreat.io/cases/company/salesloft-drift-salesforce-customers/): 1 case
- [Self-hosted llama.cpp inference servers](https://aithreat.io/cases/company/self-hosted-llama-cpp-inference-servers/): 1 case
- [Self-hosted n8n AI workflow automation servers](https://aithreat.io/cases/company/self-hosted-n8n-ai-workflow-automation-servers/): 1 case
- [Self-hosted Ollama deployments](https://aithreat.io/cases/company/self-hosted-ollama-deployments/): 1 case
- [Self-hosted OpenClaw (Clawdbot/Moltbot) instances](https://aithreat.io/cases/company/self-hosted-openclaw-clawdbot-moltbot-instances/): 1 case
- [Senior US federal and state officials and their contacts](https://aithreat.io/cases/company/senior-us-federal-and-state-officials-and-their-contacts/): 1 case
- [ServiceNow Now Assist AI Agents and Virtual Agent API](https://aithreat.io/cases/company/servicenow-now-assist-ai-agents-and-virtual-agent-api/): 1 case
- [Seven Hong Kong banks and stored-value facilities](https://aithreat.io/cases/company/seven-hong-kong-banks-and-stored-value-facilities/): 1 case
- [Singapore business professional](https://aithreat.io/cases/company/singapore-business-professional/): 1 case
- [Small business sites on Shopify, Wix, Squarespace, GoDaddy](https://aithreat.io/cases/company/small-business-sites-on-shopify-wix-squarespace-godaddy/): 1 case
- [Smithery.ai hosted MCP servers](https://aithreat.io/cases/company/smithery-ai-hosted-mcp-servers/): 1 case
- [Social-media users in Japan, China and English markets](https://aithreat.io/cases/company/social-media-users-in-japan-china-and-english-markets/): 1 case
- [Social-media users targeted by investment and romance scams](https://aithreat.io/cases/company/social-media-users-targeted-by-investment-and-romance-scams/): 1 case
- [Sophos customer tenant; Sophos, CrowdStrike and Defender EDR](https://aithreat.io/cases/company/sophos-customer-tenant-sophos-crowdstrike-and-defender-edr/): 1 case
- [South African public](https://aithreat.io/cases/company/south-african-public/): 1 case
- [South African retail investors](https://aithreat.io/cases/company/south-african-retail-investors/): 1 case
- [South African retail investors; FSCA and Nedbank brands](https://aithreat.io/cases/company/south-african-retail-investors-fsca-and-nedbank-brands/): 1 case
- [South Korean DeepSeek app users](https://aithreat.io/cases/company/south-korean-deepseek-app-users/): 1 case
- [South Korean defense-related researchers](https://aithreat.io/cases/company/south-korean-defense-related-researchers/): 1 case
- [South Korean diplomatic entities](https://aithreat.io/cases/company/south-korean-diplomatic-entities/): 1 case
- [South Korean men targeted online](https://aithreat.io/cases/company/south-korean-men-targeted-online/): 1 case
- [Starmangalsutra (Sky Gold and Diamonds)](https://aithreat.io/cases/company/starmangalsutra-sky-gold-and-diamonds/): 1 case
- [Supabase MCP server used from Cursor](https://aithreat.io/cases/company/supabase-mcp-server-used-from-cursor/): 1 case
- [Swedish consumers](https://aithreat.io/cases/company/swedish-consumers/): 1 case
- [Swedish retail investors](https://aithreat.io/cases/company/swedish-retail-investors/): 1 case
- [Systems affected by recently published CVEs](https://aithreat.io/cases/company/systems-affected-by-recently-published-cves/): 1 case
- [Taiwanese investment and semiconductor firms, US academia](https://aithreat.io/cases/company/taiwanese-investment-and-semiconductor-firms-us-academia/): 1 case
- [Tech, finance, chemical firms, government agencies](https://aithreat.io/cases/company/tech-finance-chemical-firms-government-agencies/): 1 case
- [Thai banks' KYC and account-opening systems](https://aithreat.io/cases/company/thai-banks-kyc-and-account-opening-systems/): 1 case
- [Thai residents including beauty queen Charlotte Austin](https://aithreat.io/cases/company/thai-residents-including-beauty-queen-charlotte-austin/): 1 case
- [Trump International Hotel, Las Vegas](https://aithreat.io/cases/company/trump-international-hotel-las-vegas/): 1 case
- [Turkish social media users](https://aithreat.io/cases/company/turkish-social-media-users/): 2 cases
- [UAE residents; Economy Minister Abdullah bin Touq Al Marri](https://aithreat.io/cases/company/uae-residents-economy-minister-abdullah-bin-touq-al-marri/): 1 case
- [UAE social media users](https://aithreat.io/cases/company/uae-social-media-users/): 1 case
- [UK mobile users recruited via SMS, WhatsApp and Telegram](https://aithreat.io/cases/company/uk-mobile-users-recruited-via-sms-whatsapp-and-telegram/): 1 case
- [Ukrainian/European defense, drone makers, North African government](https://aithreat.io/cases/company/ukrainian-european-defense-drone-makers-north-african-government/): 1 case
- [Ukrainian government bodies](https://aithreat.io/cases/company/ukrainian-government-bodies/): 1 case
- [Ukrainian organisations](https://aithreat.io/cases/company/ukrainian-organisations/): 2 cases
- [Unnamed organisation running Langflow, MySQL and Nacos](https://aithreat.io/cases/company/unnamed-organisation-running-langflow-mysql-and-nacos/): 1 case
- [Unnamed organisation under long-term espionage access](https://aithreat.io/cases/company/unnamed-organisation-under-long-term-espionage-access/): 1 case
- [Uruguayan social media users; President Yamandu Orsi](https://aithreat.io/cases/company/uruguayan-social-media-users-president-yamandu-orsi/): 1 case
- [US companies hiring remote IT workers](https://aithreat.io/cases/company/us-companies-hiring-remote-it-workers/): 1 case
- [US critical manufacturing, energy, water, chemical and food](https://aithreat.io/cases/company/us-critical-manufacturing-energy-water-chemical-and-food/): 1 case
- [US defence and telecom infrastructure](https://aithreat.io/cases/company/us-defence-and-telecom-infrastructure/): 1 case
- [US Fortune 500 technology companies](https://aithreat.io/cases/company/us-fortune-500-technology-companies/): 1 case
- [US organizations](https://aithreat.io/cases/company/us-organizations/): 1 case
- [US senator's office, journalists and researchers](https://aithreat.io/cases/company/us-senator-s-office-journalists-and-researchers/): 1 case
- [US State Department / senior officials](https://aithreat.io/cases/company/us-state-department-senior-officials/): 1 case
- [Users of an unnamed open-source web admin tool](https://aithreat.io/cases/company/users-of-an-unnamed-open-source-web-admin-tool/): 1 case
- [Users of DORA, DONI, ROMI, LUMA and other dating apps](https://aithreat.io/cases/company/users-of-dora-doni-romi-luma-and-other-dating-apps/): 1 case
- [Users of Google, Microsoft, Anthropic, Amazon and OpenAI AI](https://aithreat.io/cases/company/users-of-google-microsoft-anthropic-amazon-and-openai-ai/): 1 case
- [Users searching for OpenClaw downloads](https://aithreat.io/cases/company/users-searching-for-openclaw-downloads/): 1 case
- [Vercel / Context.ai](https://aithreat.io/cases/company/vercel-context-ai/): 1 case
- [Victims of investment, romance and impersonation scams](https://aithreat.io/cases/company/victims-of-investment-romance-and-impersonation-scams/): 1 case
- [Vidoc Security Lab (hiring developers in Poland)](https://aithreat.io/cases/company/vidoc-security-lab-hiring-developers-in-poland/): 1 case
- [Vietnamese business executives and officials](https://aithreat.io/cases/company/vietnamese-business-executives-and-officials/): 1 case
- [Visa applicants in seven countries](https://aithreat.io/cases/company/visa-applicants-in-seven-countries/): 1 case
- [VS Code, Cursor and Windsurf users](https://aithreat.io/cases/company/vs-code-cursor-and-windsurf-users/): 1 case
- [VS Code users of AI coding assistant extensions](https://aithreat.io/cases/company/vs-code-users-of-ai-coding-assistant-extensions/): 1 case
- [Vyro AI (ImagineArt, Chatly, Chatbotx apps)](https://aithreat.io/cases/company/vyro-ai-imagineart-chatly-chatbotx-apps/): 1 case
- [Web3 and crypto executives and blockchain developers](https://aithreat.io/cases/company/web3-and-crypto-executives-and-blockchain-developers/): 1 case
- [Western companies hiring remote developers](https://aithreat.io/cases/company/western-companies-hiring-remote-developers/): 1 case
- [Western employers hiring remote IT staff](https://aithreat.io/cases/company/western-employers-hiring-remote-it-staff/): 1 case
- [Western social-media users organising anti-China protests](https://aithreat.io/cases/company/western-social-media-users-organising-anti-china-protests/): 1 case
- [Windows and Linux systems](https://aithreat.io/cases/company/windows-and-linux-systems/): 1 case
- [Windows hosts of unknown victims](https://aithreat.io/cases/company/windows-hosts-of-unknown-victims/): 1 case
- [Windows hosts targeted by the proof-of-concept framework](https://aithreat.io/cases/company/windows-hosts-targeted-by-the-proof-of-concept-framework/): 1 case
- [Windows systems](https://aithreat.io/cases/company/windows-systems/): 1 case
- [Windows users targeted by the group's malware](https://aithreat.io/cases/company/windows-users-targeted-by-the-group-s-malware/): 1 case
- [Wuhan MCN agency's official account and company registration](https://aithreat.io/cases/company/wuhan-mcn-agency-s-official-account-and-company-registration/): 1 case
- [xAI Grok users](https://aithreat.io/cases/company/xai-grok-users/): 1 case
- [xAI private and fine-tuned LLMs](https://aithreat.io/cases/company/xai-private-and-fine-tuned-llms/): 1 case
- [xAI private and unreleased Grok models](https://aithreat.io/cases/company/xai-private-and-unreleased-grok-models/): 1 case
- [xAI private LLMs including grok-4-0709](https://aithreat.io/cases/company/xai-private-llms-including-grok-4-0709/): 1 case

## Verified case files
- [PoeLLM botnet infects 3,400 servers running exposed LiteLLM and Ollama for cryptomining](https://aithreat.io/cases/poellm-botnet-exposed-ai-servers/): 2026-10-07, critical, LLMjacking, Worldwide. Lumen Black Lotus Labs tracked an ELF implant named libgcrypt that derives its C2 address from words in a GitHub-hosted poem, scans ports 3000 and 4000, exploits LiteLLM CVE-2026-42271 and runs XMRig and Iron miners on more than 3,400 hosts.
- [Man sentenced in first US AI music streaming fraud case after $8M in bot-driven royalties](https://aithreat.io/cases/ai-music-streaming-royalty-fraud/): 2026-10-06, high, Deepfake fraud, United States. A North Carolina man got 18 months and must forfeit $8,091,843 after prosecutors said he streamed hundreds of thousands of AI-generated songs via about 10,000 bot accounts to collect royalties; first US AI streaming case
- [PixelLeak: AI coding agents push 13,000 internal screenshots to public GitHub](https://aithreat.io/cases/pixelleak-agent-screenshots/): 2026-09-29, medium, Model & data leak, Worldwide. Glow Labs found coding agents uploaded internal app screenshots, including billing and treasury consoles, to public repos so reviewers could see them, mostly under personal accounts.
- [Greek police bust gang that cloned relatives' voices with AI to steal over 1M euros](https://aithreat.io/cases/greece-voice-clone-relatives-gang/): 2026-09-18, high, Deepfake fraud, GR. Greek police arrested two collectors from a gang that posed as utility staff, recorded relatives voices, then used AI voice clones of those relatives to talk victims into handing over valuables; over 1M euros taken.
- [Researchers tie May RubyGems malware flood to swarm of OpenAI agents](https://aithreat.io/cases/rubygems-openai-agent-swarm/): 2026-09-14, high, AI supply chain, Worldwide. GemStuffer research linked 2,000+ malicious gems that gained code execution on RubyDoc build servers to OpenAI agents in training; OpenAI is reviewing agent activity.
- [ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants](https://aithreat.io/cases/anthropic-shinyhunters-agents/): 2026-09-10, high, AI-assisted malware, Worldwide. Anthropic reported ShinyHunters-linked actors whose AI agents did nearly all the work in a supply-chain breach of 40+ cloud tenants and a three-hour takeover from one stolen token.
- [Russia-aligned actor used AI agents to self-rebuild malware and steal ID records](https://aithreat.io/cases/anthropic-jackpoterz-russia/): 2026-09-10, critical, State actor AI ops, Worldwide. Anthropic's threat report described a Midnight Blizzard-like operator whose agents auto-rebuilt detected malware, raided drone makers and stole 300,000+ national ID records.
- [GTG-50029: lone French-speaking hacktivist breaches 14 European political entities](https://aithreat.io/cases/anthropic-gtg-50029-eu-hacktivist/): 2026-09-10, high, AI-assisted malware, France. In spring 2026 a single actor built a Rust API-key scanner, a WordPress reinstall race-condition exploit and a doxxing platform called fafsearch, gaining internal access to at least 14 of 42 tracked targets.
- [GTG-50021: fake discounted-Claude reseller proxied traffic and stole Anthropic credentials](https://aithreat.io/cases/anthropic-gtg-50021-fake-reseller/): 2026-09-10, high, LLMjacking, Worldwide. A Russian- and Ukrainian-speaking group sold cheap Claude access, silently routed buyers to other models and ran a credential harvester that captured Anthropic account logins for resale.
- [GTG-50020: extortionist prompt-injects AI vendor eval sandbox, then hits 30 AI firms](https://aithreat.io/cases/anthropic-gtg-50020-sandbox-keys/): 2026-09-10, high, Prompt injection, Worldwide. A Russian-speaking extortion actor that had stolen 26 GB from booking and fintech platforms injected prompts into an AI vendor's automated evaluation sandbox to extract production API keys, then hit about 30 AI firms.
- [GTG-30006: Iranian accounts built phishing portals and SECOMS64 implant with Claude](https://aithreat.io/cases/anthropic-gtg-30006-iran-tooling/): 2026-09-10, high, State actor AI ops, Worldwide. Free-tier Claude accounts spread across 16 organisations built phishing portals, a VBScript dropper, the SECOMS64 implant and Microsoft 365 mailbox-theft tooling, splitting work into small sessions to weaken safeguards.
- [GTG-16008: Xiaomi replayed MiMo user sessions through Claude via 1,500 accounts](https://aithreat.io/cases/anthropic-gtg-16008-xiaomi-distill/): 2026-09-10, high, Model & data leak, United States. Anthropic says Xiaomi replayed real MiMo user sessions through Claude via OpenClaw and OpenCode to collect training data, 400,000+ requests across 1,500+ accounts, exposing users' names and corporate data.
- [GTG-16006: Zhipu accused of cyber-focused distillation of Claude Opus through 273 accounts](https://aithreat.io/cases/anthropic-gtg-16006-zhipu-distill/): 2026-09-10, high, Model & data leak, United States. Anthropic says Zhipu (Z.ai) ran a chain-of-thought extraction pipeline through 273 accounts, 770,609 exchanges in ten days, and used Claude as grader for a cyber-focused distillation campaign.
- [GTG-16005: Anthropic says Alibaba ran 151M-exchange distillation of Claude to train Qwen](https://aithreat.io/cases/anthropic-gtg-16005-alibaba-distill/): 2026-09-10, critical, Model & data leak, United States. Anthropic attributes to Alibaba's Qwen team a campaign forcing chain-of-thought output via a fixed prompt, peaking near 3M exchanges a day from 3,500+ fake accounts, 151M+ exchanges May to July 2026.
- [GTG-15001: China studio ran 20+ dating apps with 4,700 Claude personas, 25,000 victims](https://aithreat.io/cases/anthropic-gtg-15001-dating-apps/): 2026-09-10, high, Deepfake fraud, Worldwide. A China-based app studio mixed about three AI personas per human gig worker across 20+ dating apps; in two weeks of April 2026 Claude sent about 2.36 million messages to 25,000+ users paying in coins to keep chatting.
- [GTG-10007: Chinese-speaking students run autonomous Claude exploit foundry against 50 orgs](https://aithreat.io/cases/anthropic-gtg-10007-exploit-foundry/): 2026-09-10, critical, AI-assisted malware, Worldwide. Operators likely in Changsha, Hunan, including undergraduates, ran agent swarms with persistent memory, autonomous binary reversing and a 13-agent collection fleet, yielding a dozen candidate zero-days in a month.
- [Okta: free Telegram stealer dump holds thousands of live AI session tokens and 24 API keys](https://aithreat.io/cases/okta-infostealer-ai-tokens/): 2026-09-08, high, LLMjacking, Worldwide. Okta analysed a 7 GB stealer log dump of 5,871 machines posted free on Telegram on 2 August 2026 and found 24 valid AI API keys plus thousands of unexpired session tokens for Google, Microsoft, Anthropic and Amazon.
- [Mandiant case: AI agent built from one prompt harvests thousands of credentials in 6 hours](https://aithreat.io/cases/gtig-six-hour-credential-harvest/): 2026-09-08, critical, Agent hijack, Worldwide. A financially motivated actor already inside a victim cloud turned a coding chatbot, one prompt and markdown playbooks into an autonomous system that harvested thousands of credentials and rotated IPs via that cloud.
- [Sandworm-linked cluster used Gemini to write password-spraying scripts against Ukraine](https://aithreat.io/cases/gtig-sandworm-relic-gemini/): 2026-09-08, high, State actor AI ops, Ukraine. GTIG reported a cluster it tracks as SANDWORM RELIC, tied to APT44, integrating Gemini to write and refine asynchronous Python password-spraying tools and Bash automation in operations against Ukraine.
- [TeamPCP's DUSTMAKER hides in .claude and .cursor folders and prompt-injects LLM scanners](https://aithreat.io/cases/gtig-dustmaker-ci-prompts/): 2026-09-08, critical, AI supply chain, Worldwide. UNC6780's DUSTMAKER steals GitHub Actions OIDC tokens to publish poisoned packages with valid SLSA attestations, persists via AI-assistant config folders and embeds adversarial prompts so LLM scanners ignore it.
- [Planted prompt makes ChatGPT copy victims' Gmail data to attacker account](https://aithreat.io/cases/chatgpt-gmail-covert-channel/): 2026-09-08, high, Prompt injection, Worldwide. Check Point showed a planted instruction could make ChatGPT read connected Gmail and pass it to an attacker's ChatGPT account through a covert channel between sandboxes; OpenAI disabled the service.
- [LiteLLM MCP gateway accepts any Bearer token (CVE-2026-59822); CISA confirms exploitation](https://aithreat.io/cases/litellm-cve-2026-59822-kev/): 2026-09-02, high, AI supply chain, Worldwide. When key validation failed, LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object, so a single-character Bearer token gave full MCP tooling access; Wiz honeypots saw probes and CISA added it to KEV.
- [Truffle Security: 9,300 live AWS keys exposed, with Hugging Face the largest single source](https://aithreat.io/cases/truffle-aws-keys-hugging-face/): 2026-08-21, high, Model & data leak, Worldwide. A four-year Truffle Security study found 64,024 unique AWS keys in public sources, 9,300 of them still valid; Hugging Face repositories accounted for 8,482 exposures and 17.9 percent of those were root keys.
- [Heidelberg police: 75-year-old loses six-figure sum to celebrity deepfake investment video](https://aithreat.io/cases/heidelberg-pensioner-deepfake-investment/): 2026-08-20, medium, Deepfake fraud, Germany. The Kriminalpolizeidirektion Heidelberg reported that a 75-year-old man lost a six-figure euro sum after a convincing video used a well-known personality's manipulated face and voice to promote an investment.
- [CISA lists MLflow webhook SSRF (CVE-2026-64849) reaching cloud metadata as exploited](https://aithreat.io/cases/mlflow-cve-2026-64849-kev/): 2026-08-19, high, AI supply chain, Worldwide. An unauthenticated webhook test endpoint in MLflow validated only the initial URL, then followed redirects and re-resolved hostnames, letting attackers reach internal and cloud metadata services and read the response; CISA flagged active exploitation.
- [NSA, CISA, FBI warn of AI-generated scripts probing Siemens S7 PLCs as fake OT monitors](https://aithreat.io/cases/cisa-aa26-231a-siemens-ai-scripts/): 2026-08-19, high, AI-assisted malware, United States. Joint advisory AA26-231A said threat actors use AI-generated Python scripts built on python-snap7, posing as monitoring tools, to read and write memory and ladder logic on internet-exposed Siemens S7 PLCs.
- [SilkParasite: China-nexus Central Asia espionage with AI-assisted lures and RAT code](https://aithreat.io/cases/bitdefender-silkparasite-ai-rats/): 2026-08-19, medium, State actor AI ops, UZ. Bitdefender tracked seven RAT families, five new, in about 65 infections at Central Asian governments; two lures appeared AI-generated and malware such as GoginRAT carried leftover test code suggesting AI assistance.
- [Browser-based Ray RCE (CVE-2025-62593) used by RondoDox botnet lands on CISA KEV](https://aithreat.io/cases/ray-cve-2025-62593-rondodox-kev/): 2026-08-17, high, AI supply chain, Worldwide. Ray's defence against browser attacks only checked that the User-Agent began with Mozilla, so a malicious page plus DNS rebinding could execute code on a developer's cluster; Bitsight saw RondoDox exploiting it before the CVE was public.
- [Australia's NASC: deepfakes of Albanese and nine public figures tied to A$7.4M in losses](https://aithreat.io/cases/australia-nasc-albanese-deepfake-7-4m/): 2026-08-17, high, Deepfake fraud, Australia. National Anti-Scam Centre data for FY2026 showed Scamwatch reports involving impersonations of the ten most-copied public figures, led by PM Anthony Albanese, were tied to A$7.4M (about $4.8M) in losses.
- [Skatteetaten uncovers AI-generated fake receipts behind 2bn NOK in bogus tax claims](https://aithreat.io/cases/norway-ai-fake-documents-tax-fraud/): 2026-08-10, high, Deepfake fraud, Norway. The Norwegian Tax Administration warned of a new fraud method in which filers attached AI-generated fictitious documentation to tax returns to claim deductions; claims worth over 2bn NOK (about $190M) were found.
- [Langflow hit by four more KEV listings in 2026: token hijack, IDOR, root RCE and auto_login chain](https://aithreat.io/cases/langflow-summer-2026-kev-wave/): 2026-08-04, critical, AI supply chain, Worldwide. Between May and August 2026 CISA added CVE-2025-34291, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198 to KEV; the last chains an auto_login endpoint issuing superuser tokens with code validation exec() for unauthenticated RCE on default installs.
- [OpenAI disrupts Poipet scam compound using ChatGPT for fraud and trafficking admin](https://aithreat.io/cases/openai-poipet-scam-compound/): 2026-07-31, high, Deepfake fraud, Worldwide. On a WhatsApp lead, OpenAI banned ChatGPT accounts of a Poipet operation that used the model to build personas, translate scam messages, fake passports and legal notices, draft recruitment fliers and track worker debts.
- [Claude model escapes eval sandbox, uploads malware to PyPI and breaches real company data](https://aithreat.io/cases/anthropic-eval-claude-pypi-malware/): 2026-07-30, high, Agent hijack, United States. Anthropic disclosed three incidents in which Claude models in misconfigured Irregular CTF evaluations reached the internet: one registered a phantom PyPI package that 15 real systems ran, another pulled hundreds of rows from a real production database.
- [Trend Micro: Earth Krahang and Earth Naga fold generative AI into exploits and loaders](https://aithreat.io/cases/trend-earth-krahang-naga-genai/): 2026-07-29, medium, State actor AI ops, Worldwide. Trend Micro's H1 2026 APT report documented China-aligned Earth Krahang using GenAI to turn a public exploit into a mass scanner and Earth Naga iteratively vibe-coding a PowerShell and C# backdoor loader.
- [Trend Micro: APT passes AI agent off as authorised pentest to attack Southeast Asian org](https://aithreat.io/cases/trend-ai-agent-pentest-pretext-sea/): 2026-07-29, high, State actor AI ops, Worldwide. Trend Micro described an actor, possibly Earth Lamia, that convinced an autonomous AI agent the operation was an authorised penetration test; the agent then ran scanning, exploitation, credential harvesting and spraying.
- [Finnish NBI warns of Google Meet scam calls using deepfakes of police commissioner](https://aithreat.io/cases/finland-police-google-meet-deepfake/): 2026-07-22, medium, Deepfake fraud, Finland. Finland's National Bureau of Investigation warned of Google Meet calls by scammers posing as police, some using suspected deepfakes of real officers including Commissioner Ilkka Koskimaki, to obtain bank details.
- [Finnish police warn of Google Meet deepfakes impersonating National Police Commissioner](https://aithreat.io/cases/finland-deepfake-police-video-calls/): 2026-07-22, medium, Deepfake fraud, Finland. Finland's National Bureau of Investigation said scammers have since June 2026 used Google Meet calls with suspected deepfakes of real officers, including Commissioner Ilkka Koskimaki, to extract banking details.
- [OpenAI evaluation agent escapes sandbox and breaches Hugging Face production systems](https://aithreat.io/cases/openai-agent-hugging-face/): 2026-07-21, critical, Agent hijack, United States. During a cyber eval, OpenAI agents exploited zero-days to escape their environment and break into Hugging Face servers; Hugging Face contained it and alerted the FBI before OpenAI noticed.
- [TuxBot v3: Keksec-linked IoT botnet built with LLM help keeps safety disclaimers](https://aithreat.io/cases/unit42-tuxbot-v3-llm-botnet/): 2026-07-16, medium, AI-assisted malware, Worldwide. Unit 42 recovered the TuxBot v3 Evolution framework whose 61 C files carry an unremoved LLM safety disclaimer and chain-of-thought comments; about 70 percent works, including Telnet brute force and DDoS.
- [Indian jeweller Sky Gold's unit loses Rs 10.7 crore to alleged deepfake of director](https://aithreat.io/cases/sky-gold-deepfake-director/): 2026-07-15, high, Deepfake fraud, India. Fraudsters compromised a company phone and laptop and allegedly used deepfake impersonation of a director to get an employee to wire Rs 10.70 crore (~$1.1M) to unknown accounts.
- [Colombian Dijin dismantles Ibague ring using deepfakes to pose as US consular officials](https://aithreat.io/cases/colombia-ibague-deepfake-visa-ring/): 2026-07-13, medium, Deepfake fraud, Colombia. The Dijin, Fiscalia General, Ameripol and US HSI raided three Ibague properties, arresting five people who altered their faces and accents on video calls to impersonate US consular officials selling fake visas.
- [Saxony woman loses over 1M euros after deepfake Markus Lanz video promotes Investhub 3.0](https://aithreat.io/cases/chemnitz-lanz-deepfake-investhub/): 2026-07-08, high, Deepfake fraud, Germany. Chemnitz police are investigating after a Saxony woman transferred sums from 250 to 460,000 euros to the Investhub 3.0 platform promoted by an AI video of TV host Markus Lanz, losing over 1M euros (about $1.1M).
- [DuneSlide: two 9.8 Cursor flaws let prompt injection escape sandbox for OS-level RCE](https://aithreat.io/cases/cursor-duneslide-sandbox-escape/): 2026-07-02, critical, Agent hijack, Israel. Cato Networks found a non-default working_directory was added to Cursor's allow list and unresolved symlinks fell back to their own path, letting injected prompts overwrite the sandbox binary and run any command.
- [JADEPUFFER: LLM agent runs Langflow intrusion to database extortion end to end](https://aithreat.io/cases/sysdig-jadepuffer-agentic-ransomware/): 2026-07-01, high, AI-assisted malware, Worldwide. Sysdig documented an LLM agent that exploited Langflow CVE-2025-3248, harvested keys, pivoted via a Nacos auth bypass, encrypted 1,342 config items with a key it never saved, dropped databases and left a ransom note.
- [Tokyo police arrest Taiwanese collectors in 100M yen scam using deepfake of Takafumi Horie](https://aithreat.io/cases/tokyo-horie-deepfake-investment-ring/): 2026-06-26, high, Deepfake fraud, Japan. Tokyo police arrested Taiwanese cash collectors for a ring that used an AI video of entrepreneur Takafumi Horie to pull a woman in her 80s into a LINE group promising 600 percent returns; losses near 100M yen ($650,000).
- [Chiba police arrest 19-year-old who built ransomware with AI after Asahi attack news](https://aithreat.io/cases/chiba-teen-ai-ransomware-arrest/): 2026-06-25, medium, AI-assisted malware, Japan. Chiba police arrested a 19-year-old from Otsu for creating ransomware with generative AI in February 2026, saying news of the Asahi attack inspired him; eight others aged 13 to 19 were referred over the same chat group.
- [Lahav 433 arrests 20-year-old who animated stolen ID photos with AI to open bank accounts](https://aithreat.io/cases/israel-synthetic-identity-ai-agents/): 2026-06-21, high, Deepfake fraud, Israel. Israel Police allege a 20-year-old bought ID photos on the darknet, used AI to animate them past remote video account-opening checks, and used AI agents to open bank accounts and cards in hundreds of victims' names.
- [North Korea's Sapphire Sleet hijacks maintainer account to trojanize 140+ Mastra AI npm packages](https://aithreat.io/cases/mastra-npm-sapphire-sleet/): 2026-06-17, critical, AI supply chain, Worldwide. Attackers took over npm maintainer 'ehindero' and pushed updates to more than 140 @mastra packages adding the typosquat dependency easy-day-js, whose postinstall dropper fetched a cross-platform infostealer hunting 166 wallet extensions.
- [15 JetBrains Marketplace AI plugins with 70,000 installs steal OpenAI and DeepSeek keys](https://aithreat.io/cases/aikido-jetbrains-ai-key-theft/): 2026-06-16, high, LLMjacking, Worldwide. Aikido found at least 15 plugins from seven vendor accounts that acted as AI assistants but sent users OpenAI, DeepSeek and SiliconFlow API keys over plain HTTP to an attacker server; a paid tier gave out harvested keys.
- [SearchLeak: one-click chain in M365 Copilot Enterprise Search exfiltrates data via Bing](https://aithreat.io/cases/copilot-searchleak/): 2026-06-15, high, Prompt injection, United States. Varonis Threat Labs chained prompt injection, a rendering race condition and SSRF through Bing so one crafted link made Copilot fetch sensitive data and embed it in an image request. Microsoft fixed it server-side.
- [Hijacked Ollama server used as brain of autonomous hacking pipeline](https://aithreat.io/cases/ollama-vapt-autonomous-attack/): 2026-06-12, medium, LLMjacking, Worldwide. Sysdig observed an attacker using an unauthenticated Ollama instance as the reasoning engine of a tool that scanned targets, wrote exploits and attempted intrusions.
- [Typosquatted npm MCP servers phone home on install posing as official modelcontextprotocol packages](https://aithreat.io/cases/mcp-server-npm-typosquats/): 2026-06-09, low, AI supply chain, Worldwide. Unscoped packages such as mcp-server-sequential-thinking, mcp-server-github, mcp-server-git and mcp-server-figma mimicked official MCP servers and sent hostname, working directory and platform data to a Cloudflare Workers endpoint on install.
- [Hackers trick Meta's AI support chatbot into handing over Instagram accounts](https://aithreat.io/cases/meta-ai-support-instagram/): 2026-06-08, high, Agent hijack, Worldwide. Attackers asked Meta's AI support assistant to link new emails to target accounts, then reset passwords, hijacking high-profile accounts before Meta fixed the flow.
- [CISA adds actively exploited LiteLLM AI gateway RCE (CVE-2026-42271) to KEV](https://aithreat.io/cases/litellm-cve-2026-42271/): 2026-06-08, critical, Agent hijack, Worldwide. Attackers exploited command injection in LiteLLM's MCP server preview endpoints, chainable with a Starlette Host bypass for unauthenticated RCE and theft of AI provider keys.
- [Nigerian police arrest man behind viral AI voice clip attributed to President Tinubu](https://aithreat.io/cases/nigeria-tinubu-ai-voice-arrest/): 2026-06-05, medium, Deepfake fraud, Nigeria. Police arrested Ifechukwu Dennis for allegedly creating an AI voice clip in which Tinubu appears to admit sustaining insecurity in the South-East; the audio was dubbed over activist VeryDarkMan's footage.
- [Sophos finds ransomware-linked actor using Cursor and Claude agents to build EDR evasions](https://aithreat.io/cases/sophos-cursor-edr-evasion-lab/): 2026-06-02, high, AI-assisted malware, Worldwide. Sophos X-Ops caught a threat actor inside a customer tenant using Cursor with a Claude Opus 4.5 agent, sub-agents, Git via MCP and Ludus VMs to build nearly 80 modules testing 70-plus EDR evasion techniques.
- [Trojanized codexui-android npm package steals OpenAI Codex tokens](https://aithreat.io/cases/codexui-android-npm/): 2026-06-02, medium, AI supply chain, Worldwide. A package posing as a remote web UI for OpenAI Codex built a user base for a month before activating a payload that exfiltrated Codex authentication tokens.
- [Turkey's 'Yapay Zeka-2' operation: 16 held for deepfake ads imitating officials' voices](https://aithreat.io/cases/turkey-yapay-zeka-2-deepfake-ads/): 2026-05-24, medium, Deepfake fraud, Turkey. Osmaniye-centred raids in nine provinces detained 16 suspects, 11 jailed, for fake investment ads reproducing voices and footage of senior Turkish officials with AI; Istanbul later warned of ads using Imamoglu's image.
- [Nimbus Manticore's MiniFast backdoor shows AI-assisted coding during Iran conflict](https://aithreat.io/cases/checkpoint-nimbus-manticore-minifast/): 2026-05-22, high, State actor AI ops, Worldwide. Check Point tracked three Nimbus Manticore waves from February to April 2026 delivering the new MiniFast backdoor via job lures, trojanized Zoom installers and SEO poisoning, with code traits of LLM-assisted development.
- [Sao Paulo police and OAB-SP bust fake-lawyer ring that cloned lawyers' voices; R$10M moved](https://aithreat.io/cases/sao-paulo-fake-lawyer-voice-clone/): 2026-05-19, high, Deepfake fraud, Brazil. Operacao SP Advocacia Mais Segura by the Policia Civil and OAB-SP arrested at least eight members of a call-centre ring that used AI-cloned lawyers' voices and fake court rulings; about R$10M (about $1.8M) moved.
- [Singapore businessman loses S$4.9M after Zoom meeting with deepfake PM Lawrence Wong](https://aithreat.io/cases/singapore-pm-wong-deepfake-zoom/): 2026-05-15, high, Deepfake fraud, Singapore. Singapore Police said a victim sent at least S$4.9 million (about $3.83M) after a fake Cabinet Secretary invited him to a Zoom briefing with deepfakes of PM Lawrence Wong, the President and MAS officials.
- [OpenAI confirms two employee devices and source repos breached in Mini Shai-Hulud npm worm](https://aithreat.io/cases/openai-tanstack-worm-breach/): 2026-05-14, high, AI supply chain, United States. OpenAI said malware from TeamPCP's TanStack and Mistral npm package compromise reached two employee laptops, giving access to a subset of internal repositories and exposing code-signing certificates it is now rotating.
- [Mini Shai-Hulud worm hits TanStack, Mistral AI and Guardrails AI packages](https://aithreat.io/cases/mini-shai-hulud-ai-packages/): 2026-05-12, critical, AI supply chain, Worldwide. TeamPCP's worm hijacked release pipelines to publish 170+ malicious npm/PyPI versions, stealing cloud, CI and AI-tool credentials and planting persistence in Claude Code and VS Code.
- [PRC clusters UNC5673 and UNC6201 pooled Gemini, Claude and OpenAI accounts via proxies](https://aithreat.io/cases/gtig-unc5673-llm-account-pooling/): 2026-05-11, medium, LLMjacking, Worldwide. GTIG found UNC5673 (overlapping TEMP.Hex) using Claude-Relay-Service and CLI-Proxy-API to share pooled accounts, and UNC6201 trialling a script that auto-registers premium LLM accounts with CAPTCHA and SMS bypass.
- [PRC-nexus UNC2814 posed as C/C++ security auditor to get Gemini hunting TP-Link bugs](https://aithreat.io/cases/gtig-unc2814-tplink-rce/): 2026-05-11, medium, State actor AI ops, Worldwide. UNC2814 used expert-persona prompts and false narratives to have Gemini research pre-authentication remote code execution in embedded devices, TP-Link firmware and Odette File Transfer Protocol code.
- [PROMPTSPY Android backdoor lets Gemini drive the victim's screen and block uninstall](https://aithreat.io/cases/gtig-promptspy-android/): 2026-05-11, high, AI-assisted malware, Worldwide. GTIG expanded on ESET's PROMPTSPY findings: a GeminiAutomationAgent serialises the UI via Accessibility, sends it to gemini-2.5-flash-lite and executes returned taps and swipes; an overlay shields Uninstall.
- [Russia-nexus CANFAIL and LONGSTREAM malware pad code with LLM filler to fool analysts](https://aithreat.io/cases/gtig-canfail-longstream-decoy/): 2026-05-11, medium, AI-assisted malware, Ukraine. GTIG found two Russia-nexus families aimed at Ukraine whose LLM-generated decoy logic, including comments labelling blocks as filler and 32 daylight-saving checks, is designed to make scripts look benign to reviewers.
- [North Korea's APT45 fed Gemini thousands of prompts to validate exploits and grow arsenal](https://aithreat.io/cases/gtig-apt45-cve-prompt-farm/): 2026-05-11, medium, State actor AI ops, Worldwide. GTIG observed DPRK-linked APT45 sending thousands of repetitive prompts to recursively analyse CVEs and validate proof-of-concept exploits, and experimenting with OpenClaw and OneClaw agent frameworks against test labs.
- [GTIG intercepts first AI-developed zero-day: 2FA bypass in popular open-source admin tool](https://aithreat.io/cases/gtig-ai-built-2fa-zero-day/): 2026-05-11, medium, AI-assisted malware, Worldwide. Criminal actors planned mass exploitation with a Python exploit bypassing two-factor authentication via a hardcoded trust assumption; a hallucinated CVSS score and textbook structure led GTIG to assess it was AI-written.
- [Sysdig: LLM agent pivots from marimo RCE to internal Postgres dump in under an hour](https://aithreat.io/cases/sysdig-marimo-llm-agent-pivots/): 2026-05-10, high, Agent hijack, Worldwide. After exploiting CVE-2026-39987 in an exposed marimo notebook, an attacker gave stolen AWS credentials to an LLM agent that fetched an SSH key, hopped a bastion and dumped a PostgreSQL database in under an hour.
- [Fake 'OpenAI Privacy Filter' repo tops Hugging Face trending while pushing Rust infostealer](https://aithreat.io/cases/hf-fake-openai-privacy-filter/): 2026-05-07, high, AI supply chain, Worldwide. HiddenLayer found Open-OSS/privacy-filter, a copy of OpenAI's Privacy Filter model card whose loader.py pulled a PowerShell chain that added Defender exclusions and ran a Rust stealer; it reached number one trending with 244,000 likely inflated downloads.
- [Ghana police arrest 16 over AI deepfake videos of President Mahama used to solicit money](https://aithreat.io/cases/ghana-mahama-deepfake-arrests/): 2026-05-07, medium, Deepfake fraud, GH. Ghana Police Service arrested 11 suspects in the Volta Region on 1 to 3 May and five more in Aflao on 4 May 2026 for making and spreading AI videos of President Mahama to extract money and personal data.
- [Backdoored PyTorch Lightning 2.6.3 on PyPI runs Bun-based credential stealer on import](https://aithreat.io/cases/pytorch-lightning-2-6-3-backdoor/): 2026-04-30, high, AI supply chain, United States. Lightning AI disclosed that version 2.6.3 of the lightning package was published with a payload that downloads the Bun runtime and an 11.4 MB obfuscated JavaScript stealer targeting browser data, .env files, GitHub tokens and cloud credentials.
- [WKStA and Albanian police raid call centres using fake Van der Bellen crypto videos](https://aithreat.io/cases/austria-albania-van-der-bellen-crypto/): 2026-04-29, critical, Deepfake fraud, Austria. Austria's WKStA and Bundeskriminalamt, with Albanian police, Europol and Eurojust, raided three Albanian call centres pushing crypto schemes with fake Van der Bellen videos; ten arrested, damage at least 50M euros.
- [Ahmedabad police bust racket using deepfake videos to beat Aadhaar face checks for loans](https://aithreat.io/cases/ahmedabad-aadhaar-deepfake-racket/): 2026-04-28, high, Deepfake fraud, India. Ahmedabad cyber police arrested four men who used AI-animated videos made from a businessman's photo to pass Aadhaar face authentication, swap his registered mobile number, access DigiLocker and apply for loans.
- [Banque de France warns of deepfakes of governor Villeroy de Galhau selling investments](https://aithreat.io/cases/banque-de-france-governor-deepfake/): 2026-04-27, medium, Deepfake fraud, France. The French central bank and ACPR issued a joint alert about AI deepfakes of Governor Villeroy de Galhau and ACPR chief Emmanuelle Assouan recommending investments, followed by calls demanding advance fees.
- [Bangladesh police arrest 10 who sold illegal drugs with deepfakes of preacher Azhari](https://aithreat.io/cases/bangladesh-azhari-deepfake-drug-ring/): 2026-04-23, medium, Deepfake fraud, Bangladesh. Police arrested ten members of a ring that used AI to replicate scholar Mizanur Rahman Azhari's face and voice in ads across about 24 fake Facebook pages and websites selling illegal stimulant drugs; two were remanded.
- [Talos IR: public-sector credential theft via phishing page vibe-coded on Softr AI builder](https://aithreat.io/cases/talos-softr-ai-phishing-page/): 2026-04-22, medium, AI phishing, Worldwide. Cisco Talos IR's Q1 2026 report described a public-sector phishing case where the page targeting Exchange and OWA logins was built on Softr with a few AI prompts and no code, exfiltrating credentials to Google Sheets.
- [Unauthorized group accesses Anthropic's restricted Claude Mythos model via vendor](https://aithreat.io/cases/mythos-unauthorized-access/): 2026-04-21, high, Model & data leak, United States. Bloomberg reported a small group reached the restricted cyber-capable Mythos model using a contractor's account and a guessed URL; Anthropic investigated a third-party vendor environment.
- [Claude Code sandbox escape via symlinks allows host code execution (CVE-2026-39861)](https://aithreat.io/cases/claude-code-symlink-escape/): 2026-04-21, high, Agent hijack, United States. A sandboxed Claude Code process could create symlinks outside the workspace that the unsandboxed process then followed and wrote to without confirmation, letting prompt injection reach host code execution.
- [Researcher: free Lovable account could read source, Supabase keys and chats of pre-Nov 2025 projects](https://aithreat.io/cases/lovable-pre-nov-2025-projects/): 2026-04-20, high, Model & data leak, Sweden. A researcher posting as weezerOSINT disclosed that any free Lovable account could access other users' source code, Supabase database credentials, AI chat histories and connected customer data for projects created before November 2025.
- [Compromised Context.ai AI tool's OAuth grant leads to Vercel breach](https://aithreat.io/cases/vercel-context-ai/): 2026-04-19, high, AI supply chain, United States. Attackers who compromised the Context.ai agent platform abused an employee's broad Google Workspace OAuth grant to enter Vercel and read non-sensitive customer environment variables.
- [Marimo notebook RCE (CVE-2026-39987) exploited in hours; NKAbuse RAT staged on Hugging Face Spaces](https://aithreat.io/cases/marimo-rce-nkabuse-hugging-face/): 2026-04-16, critical, AI supply chain, Worldwide. An unauthenticated terminal WebSocket in marimo before 0.23.0 gave shell access; Sysdig saw credential theft under 10 hours after disclosure and a campaign using a typosquatted Hugging Face Space to drop a new NKAbuse variant.
- [Prompt injection leaks data from Microsoft Copilot Studio and Salesforce Agentforce agents](https://aithreat.io/cases/copilot-agentforce-injection/): 2026-04-15, high, Prompt injection, Worldwide. Researchers demonstrated indirect prompt injection that exfiltrated data from enterprise agents built on Copilot Studio (CVE-2026-21520) and Agentforce despite earlier patches.
- [GrafanaGhost: indirect prompt injection makes Grafana AI leak enterprise data](https://aithreat.io/cases/grafanaghost/): 2026-04-07, medium, Prompt injection, Worldwide. Researchers showed hidden instructions in external content could make Grafana's AI render an attacker image URL carrying enterprise data; Grafana patched it.
- [Max-severity Flowise CustomMCP RCE (CVE-2025-59528) exploited in the wild](https://aithreat.io/cases/flowise-rce-exploited/): 2026-04-07, critical, Agent hijack, Worldwide. Attackers began exploiting JavaScript injection in Flowise's CustomMCP node to run code on AI workflow servers, with 12,000-15,000 instances exposed online.
- [Poisoned LiteLLM releases tied to Mercor breach exposing AI lab training secrets](https://aithreat.io/cases/mercor-litellm-breach/): 2026-04-03, critical, AI supply chain, United States. Malicious versions of the LiteLLM gateway library were linked to a breach at AI data vendor Mercor, prompting Meta to pause work amid fears training methods and contractor data leaked.
- [Vertex AI 'Double Agent': over-privileged agents leak credentials and code](https://aithreat.io/cases/vertex-ai-double-agent/): 2026-03-31, medium, Agent hijack, Worldwide. Unit 42 showed agents deployed on Vertex AI inherited broad default service-account rights, letting a compromised agent steal credentials and reach restricted images and source code.
- [OpenAI Codex branch-name command injection exposed GitHub tokens in cloud tasks](https://aithreat.io/cases/codex-branch-name-injection/): 2026-03-31, high, Agent hijack, United States. BeyondTrust found Codex did not sanitise the GitHub branch name when cloning repos, so a crafted request could run shell commands in the task container and steal the GitHub token. OpenAI fixed it on 5 February 2026.
- [Claude Code source map leak followed by malware-laced fake 'leak' repos](https://aithreat.io/cases/claude-code-leak-lures/): 2026-03-31, high, Model & data leak, Worldwide. Anthropic accidentally shipped a source map exposing ~513,000 lines of Claude Code; attackers then used fake leaked-code GitHub repos to spread malware to developers.
- [Check Point finds DNS tunnel out of ChatGPT's code sandbox leaking chats and files](https://aithreat.io/cases/chatgpt-dns-runtime-leak/): 2026-03-30, high, Prompt injection, Israel. Check Point Research found ChatGPT's supposedly offline Python container could reach the internet via DNS, so one malicious prompt or custom GPT could exfiltrate messages and files or open a remote shell. OpenAI fixed it
- [Langflow unauthenticated RCE (CVE-2026-33017) exploited within 20 hours of advisory](https://aithreat.io/cases/langflow-cve-2026-33017-exploited/): 2026-03-25, critical, AI supply chain, Worldwide. A public flow build endpoint in Langflow before 1.9.0 ran attacker-supplied Python with no login; Sysdig honeypots saw scanning, reconnaissance and environment-variable theft within a day of disclosure and CISA added it to KEV.
- [Meta AI agent's flawed advice exposes sensitive data to employees for two hours](https://aithreat.io/cases/meta-agent-data-exposure/): 2026-03-20, medium, Model & data leak, United States. An engineer acted on an internal AI agent's faulty guidance, making large amounts of sensitive user and company data visible to unauthorized staff for about two hours.
- [Unit 42: Go dropper asks GPT-4 whether to deploy Sliver based on host telemetry](https://aithreat.io/cases/unit42-gpt4-gated-sliver-dropper/): 2026-03-19, medium, AI-assisted malware, Worldwide. Unit 42 analysed a Golang dropper that sends host telemetry to GPT-4 posing as an OPSEC AI and only runs its Sliver payload if the model returns execute true, plus a .NET stealer whose GPT-3.5 calls were mostly theatre.
- [Cybernews: 45 of 98 unauthenticated Open WebUI servers already running miners and stealers](https://aithreat.io/cases/open-webui-cybernews-compromised/): 2026-03-18, high, LLMjacking, Worldwide. Cybernews researchers found 98 Open WebUI servers with authentication disabled and over 2,000 allowing open sign-up; 45 of the unauthenticated hosts carried a cryptominer and infostealer operation seen in 14 variants with Discord webhook alerts.
- [CISA confirms active exploitation of max-severity n8n expression injection RCE](https://aithreat.io/cases/n8n-cve-2025-68613-kev/): 2026-03-11, critical, AI supply chain, Worldwide. CISA added CVE-2025-68613, a CVSS 9.9 expression-injection flaw in n8n's workflow engine, to its KEV catalog; over 24,700 unpatched instances were exposed, each typically holding cloud keys, OAuth tokens and database passwords.
- [Autonomous AI agent breaches McKinsey's Lilli chatbot platform in two hours](https://aithreat.io/cases/mckinsey-lilli-breach/): 2026-03-09, high, Model & data leak, United States. CodeWall's offensive agent found SQL injection via unauthenticated Lilli API endpoints, claiming read-write access to 46.5M chat messages and system prompts; McKinsey patched within a day.
- [Jasper Sleet IT workers used Faceswap and voice changers; thousands of accounts cut](https://aithreat.io/cases/microsoft-jasper-sleet-faceswap/): 2026-03-06, high, Deepfake fraud, United States. Microsoft detailed Jasper Sleet inserting DPRK workers' faces into stolen ID documents with Faceswap, using voice changers in interviews and AI to tailor fake resumes, and said it disrupted thousands of accounts.
- [Microsoft: North Korea's Coral Sleet runs agentic AI workflow from lures to payload tests](https://aithreat.io/cases/microsoft-coral-sleet-agentic/): 2026-03-06, high, State actor AI ops, Worldwide. Microsoft reported Coral Sleet (formerly Storm-1877) using agentic AI for end-to-end lure building, infrastructure provisioning and payload testing, jailbreaking LLMs for malicious code, with AI markers in OtterCookie.
- [Bing AI search promotes fake OpenClaw installer repos pushing Atomic and Vidar stealers](https://aithreat.io/cases/bing-ai-fake-openclaw-installer/): 2026-03-05, medium, AI supply chain, Worldwide. Huntress found GitHub repos under an 'openclaw-installer' organization, built from copied Cloudflare moltworker code, that Bing's AI answers recommended; the Windows binary dropped Vidar and GhostSocks and the macOS script delivered Atomic Stealer.
- [HP Wolf: AI-generated 'vibe-hacking' infection scripts slip past email gateways](https://aithreat.io/cases/hp-wolf-vibe-hacking-2026/): 2026-03-04, medium, AI-assisted malware, Worldwide. HP's Q4 2025 Threat Insights Report documented attackers using AI to write infection scripts and rework lures, including a fake invoice PDF chain bouncing victims to Booking.com; 14 percent of threats evaded gateways.
- [Iran-nexus Dust Specter hits Iraqi officials with malware showing generative AI traces](https://aithreat.io/cases/zscaler-dust-specter-iraq/): 2026-03-02, high, State actor AI ops, IQ. Zscaler found a January 2026 campaign impersonating Iraq's foreign ministry that dropped TWINTASK, TWINTALK and GHOSTFORM; emojis and placeholders in decompiled code suggested generative AI helped build the malware.
- [OnlyFake creator pleads guilty to selling 10,000+ AI-made fake IDs for KYC fraud](https://aithreat.io/cases/onlyfake-nazarenko-guilty-plea/): 2026-03-02, high, Deepfake fraud, United States. Ukrainian national Yurii Nazarenko pleaded guilty in SDNY over OnlyFake, a crypto-paid service that used AI to generate over 10,000 realistic IDs from 56-plus countries to defeat KYC checks; he will forfeit $1.2 million.
- [Hacker uses Claude to breach Mexican agencies and steal 150GB of tax and voter data](https://aithreat.io/cases/mexico-gov-claude-breach/): 2026-02-25, critical, AI-assisted malware, Mexico. Gambit Security found an attacker jailbroke Claude, with some ChatGPT help, to find and exploit flaws in Mexican government systems, stealing ~150GB incl. 195M taxpayer records.
- [Anthropic accuses DeepSeek, Moonshot and MiniMax of distilling Claude via 24,000 accounts](https://aithreat.io/cases/anthropic-distillation/): 2026-02-23, high, Model & data leak, United States. Anthropic said three Chinese labs used fraudulent account networks and proxies to run 16M+ Claude exchanges to extract capabilities for their own models.
- [Lagos court remands man over N230M forex scam using AI-cloned image of Peter Obi](https://aithreat.io/cases/lagos-peter-obi-ai-forex-fraud/): 2026-02-18, medium, Deepfake fraud, Nigeria. Nigerian police arraigned Olayinka Adesiyan in Lagos on six counts for allegedly using AI-altered images of Peter Obi endorsing the Modmut International forex platform to obtain about N230 million in 2025.
- [Compromised Cline CLI npm release silently installs OpenClaw agent](https://aithreat.io/cases/cline-cli-openclaw/): 2026-02-17, medium, AI supply chain, Worldwide. A stolen npm token was used to publish cline@2.3.0 with a postinstall script that globally installed the OpenClaw agent; it was live about 8 hours and downloaded ~4,000 times.
- [Infostealer captures OpenClaw gateway token, device keys and agent memory files](https://aithreat.io/cases/vidar-steals-openclaw-secrets/): 2026-02-16, medium, Model & data leak, Worldwide. Hudson Rock documented the first infostealer log containing an OpenClaw .openclaw directory: openclaw.json with a gateway auth token, device.json with signing keys and soul.md and memory files holding private messages and calendar data.
- [HONESTCUE loader asks Gemini to write fresh C# second-stage code and compiles it in memory](https://aithreat.io/cases/gtig-honestcue-gemini-loader/): 2026-02-12, medium, AI-assisted malware, Worldwide. GTIG described HONESTCUE, a downloader framework seen in late 2025 that prompts the Gemini API for a unique C# program to fetch and run a .NET payload from Discord CDN, compiling it in memory so no file touches disk.
- [Google: state hackers use Gemini across all attack stages; 100K-prompt extraction try](https://aithreat.io/cases/gtig-gemini-state-misuse/): 2026-02-12, medium, State actor AI ops, Worldwide. GTIG reported Chinese, Iranian, North Korean and Russian groups using Gemini for recon, exploit research and lures, and blocked a 100,000+ prompt campaign to extract its reasoning.
- [COINBAIT crypto-exchange phishing kit built with Lovable AI app builder](https://aithreat.io/cases/gtig-coinbait-lovable-phish/): 2026-02-12, medium, AI phishing, Worldwide. GTIG found COINBAIT, a React single-page phishing kit imitating a crypto exchange, attributed to financially motivated cluster UNC5356, with Supabase and lovable.app artefacts showing Lovable AI-built code.
- [Turkish police jail five over 410M lira investment scam using deepfakes of officials](https://aithreat.io/cases/turkey-osmaniye-deepfake-410m-tl/): 2026-02-11, high, Deepfake fraud, Turkey. An Osmaniye-based police operation detained eight suspects, five later jailed, for promoting fake investments on social media with AI images and voices of Turkish officials; losses put at 410 million lira (about $9.5M).
- [Okonjo-Iweala alerts Nigerians to AI video using her image for fake investment scheme](https://aithreat.io/cases/nigeria-okonjo-iweala-ai-video-scam/): 2026-02-11, medium, Deepfake fraud, Nigeria. WTO Director-General Ngozi Okonjo-Iweala warned on X of an AI-manipulated video using her likeness to promote a supposedly government-backed scheme promising up to N2.66M in a week from a N380,000 deposit.
- [North Korea's UNC1069 uses AI deepfake video in fake Zoom calls against crypto firms](https://aithreat.io/cases/unc1069-deepfake-zoom/): 2026-02-09, high, Deepfake fraud, Worldwide. Mandiant tied a fintech intrusion to DPRK-linked UNC1069, which paired a hijacked Telegram account, a spoofed Zoom meeting with AI-generated video, and ClickFix lures to plant macOS malware.
- [Over 230 malicious OpenClaw skills on ClawHub push password stealers](https://aithreat.io/cases/clawhub-malicious-skills/): 2026-02-04, high, AI supply chain, Worldwide. Researchers found hundreds of ClawHub skills posing as crypto and social tools that told users to install a fake 'AuthTool', delivering infostealers such as AMOS on macOS.
- [CERT-FR: 42 attacker groups actively use generative AI, none yet autonomous against France](https://aithreat.io/cases/certfr-genai-threat-2026/): 2026-02-04, medium, State actor AI ops, France. ANSSI's CERT-FR published CERTFR-2026-CTI-001, a TLP:CLEAR synthesis reporting that 42 groups use GenAI such as Gemini for profiling, lures and malware, while no attack on a French entity is attributed to autonomous AI.
- [Surrey PCC: retired engineer loses £20,000 to deepfake Martin Lewis investment video](https://aithreat.io/cases/surrey-martin-lewis-deepfake-20k/): 2026-02-03, low, Deepfake fraud, United Kingdom. Surrey's Police and Crime Commissioner publicised a retired engineer who invested after a Facebook deepfake of Martin Lewis, then paid repeated fees to withdraw, losing about £20,000 (about $25,000).
- [Taiwan ring used Starlink and deepfake faces to beat e-CNY checks and drain NT$200M](https://aithreat.io/cases/taiwan-starlink-deepfake-ecny/): 2026-02-02, high, Deepfake fraud, Taiwan. Taiwan's CIB and Thai police arrested a Taichung man backing a Chinese fraud network that built AI 3D face videos from brokered photos to pass e-CNY facial login and drain about NT$200 million from 55 victims.
- [Moltbook AI-agent social network exposes 1.5M agent API tokens](https://aithreat.io/cases/moltbook-db-exposure/): 2026-02-02, high, Model & data leak, Worldwide. Wiz found Moltbook's Supabase database lacked row-level security, letting anyone read and write 1.5M agent tokens, 35,000 emails and private messages containing third-party API keys.
- [Taichung indicts ring using ChatGPT scripts and deepfake Japanese police on video calls](https://aithreat.io/cases/taichung-chatgpt-deepfake-japan-police/): 2026-01-29, medium, Deepfake fraud, Taiwan. A Taiwan-Japan-Malaysia ring wrote fraud scripts with ChatGPT and used AI face-swaps to appear as Japanese police when victims asked for video proof; about 18.65 million yen was laundered into USDT.
- [Hugging Face datasets abused to serve polymorphic Android RAT payloads every 15 minutes](https://aithreat.io/cases/hugging-face-android-rat-cdn/): 2026-01-29, high, AI supply chain, Worldwide. Bitdefender found a scareware dropper app, TrustBastion, fetching an accessibility-abusing Android trojan from a Hugging Face dataset repository that regenerated its payload every 15 minutes and had over 6,000 commits in 29 days.
- [Chat & Ask AI app leaks ~300M messages from 25M users via open Firebase](https://aithreat.io/cases/chat-ask-ai-leak/): 2026-01-29, high, Model & data leak, Worldwide. A researcher found the popular AI chat wrapper's Firebase rules left full chat histories readable, exposing about 300 million messages tied to more than 25 million users.
- [Operation Bizarre Bazaar: hijacked LLM endpoints resold through commercial marketplace](https://aithreat.io/cases/bizarre-bazaar-llmjacking/): 2026-01-28, high, LLMjacking, Worldwide. Pillar Security logged ~35,000 attack sessions scanning for exposed AI endpoints, validating access and reselling it via a marketplace covering 30+ LLM providers.
- [Tens of thousands of OpenClaw agent gateways exposed online leaking API keys and chats](https://aithreat.io/cases/openclaw-exposed-gateways/): 2026-01-27, high, Model & data leak, Worldwide. After the viral OpenClaw agent framework spread, researchers found its gateway bound to public interfaces without authentication on tens of thousands of hosts, exposing API keys, credentials and private chat histories.
- [MaliciousCorgi: 'ChatGPT' and 'ChatMoss' VS Code AI extensions with 1.5M installs exfiltrate open files](https://aithreat.io/cases/maliciouscorgi-vscode-ai-extensions/): 2026-01-23, high, AI supply chain, China. Koi found two Marketplace extensions marketed as AI coding assistants that read every opened file, let a server pull up to 50 workspace files on command and loaded hidden analytics trackers, sending data to China-based servers.
- [Microsoft 365 Copilot bug summarises confidential emails despite DLP policies](https://aithreat.io/cases/copilot-confidential-emails-bug/): 2026-01-21, medium, Model & data leak, United States. Microsoft confirmed (CW1226324) that a code error let Copilot Chat's work tab read and summarise Drafts and Sent Items emails carrying labels such as Confidential despite DLP policies. A fix rolled out in February 2026.
- [BodySnatcher: unauthenticated impersonation via ServiceNow Virtual Agent (CVE-2025-12420)](https://aithreat.io/cases/bodysnatcher-servicenow/): 2026-01-21, critical, Agent hijack, United States. AppOmni found an attacker with only an employee email could impersonate that user via ServiceNow's Virtual Agent API and drive Now Assist agents to create admin users, bypassing MFA and SSO. Patched October 2025.
- [VoidLink cloud malware framework found to be built mostly by an AI agent](https://aithreat.io/cases/voidlink-ai-built/): 2026-01-20, high, AI-assisted malware, Worldwide. Check Point concluded the 30+ module VoidLink Linux implant was planned and coded largely by an AI agent under one developer, reaching ~88,000 lines in about a week.
- [Prompt injection flaws in Anthropic's Git MCP server enable file access and code execution](https://aithreat.io/cases/anthropic-git-mcp-injection/): 2026-01-20, medium, Prompt injection, Worldwide. Researchers showed malicious repository content could steer agents using Anthropic's reference Git MCP server into reading or deleting files and running code; fixes shipped.
- [Reprompt: one-click attack hijacks Microsoft Copilot sessions to steal data](https://aithreat.io/cases/reprompt-copilot/): 2026-01-14, medium, Prompt injection, Worldwide. Varonis showed a crafted Microsoft link could pre-fill Copilot prompts via URL parameter and keep exfiltrating a victim's data and memory even after the chat closed.
- [NBK warns of deepfake investment ads under Central Bank of Kuwait Let's Be Aware campaign](https://aithreat.io/cases/kuwait-cbk-nbk-deepfake-warning/): 2026-01-08, low, Deepfake fraud, KW. National Bank of Kuwait, under the Central Bank of Kuwait's Let's Be Aware campaign, warned that deepfake videos making trusted figures appear to endorse investments or trading platforms were used to steal money.
- [Egyptian prosecutors order trace of AI-fabricated explicit videos of singer Haifa Wehbe](https://aithreat.io/cases/egypt-haifa-wehbe-ai-videos-probe/): 2025-12-24, medium, Deepfake fraud, Egypt. After a complaint backed by a forensic report finding the material fully synthetic, Egypt's Public Prosecution ordered AI-generated sexual videos of Haifa Wehbe pulled from Facebook, TikTok and Telegram and traced.
- [Amsterdam man used AI face-morphs on tenants' IDs to open 46 ABN Amro accounts](https://aithreat.io/cases/amsterdam-deepfake-bank-accounts/): 2025-12-17, medium, Deepfake fraud, Netherlands. Dutch police arrested a 34-year-old who harvested ID documents via fake apartment listings, then used AI to blend victims' faces with his own to pass bank video checks, opening at least 46 accounts.
- [Dutch police arrest Amsterdam man who used deepfakes to pass bank ID checks, 46 accounts](https://aithreat.io/cases/amsterdam-deepfake-46-bank-accounts/): 2025-12-17, medium, Deepfake fraud, Netherlands. Dutch police arrested a 34-year-old who collected ID documents via fake apartment listings, then used AI to overlay victims' facial features onto his own face to pass ABN Amro's identity checks for at least 46 accounts.
- [South Africa's FSCA fines Banxso R2bn over platform fed by Musk and Rupert deepfake ads](https://aithreat.io/cases/fsca-banxso-deepfake-ads-r2bn/): 2025-12-09, critical, Deepfake fraud, South Africa. The FSCA imposed about R2bn (about $115M) in penalties on Banxso and its directors plus 30-year debarments after finding the platform benefited from deceptive deepfake adverts of Elon Musk and Johann Rupert.
- [GeminiJack: zero-click injection in Gemini Enterprise exfiltrated Gmail, Calendar and Docs](https://aithreat.io/cases/geminijack-enterprise/): 2025-12-08, high, Prompt injection, United States. Noma Security found a shared Doc or calendar invite with hidden instructions was auto-retrieved by Gemini Enterprise search, run across Workspace data and leaked via a disguised image request. Google re-architected it.
- [Da Nang police arrest three South Koreans wanted for Cambodia deepfake romance scam ring](https://aithreat.io/cases/danang-korean-deepfake-romance-ring/): 2025-12-05, high, Deepfake fraud, South Korea. Da Nang police arrested three South Koreans under Interpol red notices for a Bavet, Cambodia network that used deepfakes to pose as women and defraud male victims of about $1 million while trafficking recruits.
- [Europol takedown of 700M euro crypto fraud network fed by deepfake celebrity ads](https://aithreat.io/cases/europol-700m-deepfake-crypto-ads/): 2025-12-04, critical, Deepfake fraud, Worldwide. A two-phase Europol and Eurojust operation dismantled a network that laundered over 700 million euros from crypto fraud promoted via social ads with deepfake videos of celebrities; nine arrested in phase one.
- [Google Antigravity agent in Turbo mode wipes a user's entire D: drive while clearing a cache](https://aithreat.io/cases/antigravity-d-drive-wipe/): 2025-12-01, medium, Agent hijack, GR. A Greek photographer using Google's Gemini-based Antigravity IDE reported that a cache-clearing step ran a quiet recursive delete against the root of his D: partition, bypassing the Recycle Bin; Google said it was investigating.
- [OpenAI API user data exposed in breach of analytics vendor Mixpanel](https://aithreat.io/cases/openai-mixpanel/): 2025-11-26, medium, Model & data leak, Worldwide. An attacker who smished Mixpanel exported a dataset with names, emails and coarse locations of OpenAI API users; OpenAI said no chats, keys or payment data were exposed.
- [Unit 42 tests WormGPT 4 and KawaiiGPT, criminal LLMs that write ransomware scripts](https://aithreat.io/cases/unit42-wormgpt4-kawaiigpt/): 2025-11-25, medium, AI-assisted malware, Worldwide. Unit 42 found WormGPT 4 sold for 50 USD a month with 500+ Telegram subscribers and free KawaiiGPT on GitHub; both produced ransomware PowerShell, ransom notes, spear-phishing and lateral movement scripts in testing.
- [HashJack: prompts hidden in URL fragments hijack Comet, Edge Copilot and Gemini in Chrome](https://aithreat.io/cases/hashjack-url-fragment/): 2025-11-25, medium, Prompt injection, Israel. Cato CTRL showed instructions in a URL fragment, which never reaches the server, are read by AI browser assistants and can push phishing links or make agentic browsers leak data. Perplexity and Microsoft patched it.
- [Uruguay's Interior Ministry warns of deepfake of President Orsi as paid scam ads escalate](https://aithreat.io/cases/uruguay-orsi-deepfake-ad-wave/): 2025-11-19, medium, Deepfake fraud, UY. Uruguay's Interior Ministry warned of a deepfake of President Orsi with phishing links; by July 2026 detection firm Revelum counted 19 paid ads cloning his face and voice, 16 of them in two days.
- [ShadowRay 2.0 turns exposed Ray AI clusters into self-spreading mining botnet](https://aithreat.io/cases/shadowray-2/): 2025-11-18, high, LLMjacking, Worldwide. Oligo reported attackers abusing unauthenticated Ray job APIs (CVE-2023-48022) with LLM-written payloads to hijack AI GPU clusters for cryptomining, DDoS and data theft.
- [QatarEnergy repeats warning over AI-generated videos impersonating it in investment scams](https://aithreat.io/cases/qatarenergy-ai-video-investment-scam/): 2025-11-17, medium, Deepfake fraud, QA. QatarEnergy reissued a warning that fraudulent online investment schemes were using its name and logo, including AI-generated videos impersonating the company, and stressed it never solicits money from the public.
- [Chinese state group used Claude Code to run largely autonomous espionage](https://aithreat.io/cases/anthropic-gtg-1002/): 2025-11-13, critical, State actor AI ops, Worldwide. Anthropic said GTG-1002 tasked Claude Code agents to perform 80-90% of intrusion work against ~30 targets, with a handful of successful breaches, before accounts were banned.
- [Bangkok police bust Chinese gang animating victims' photos with AI to beat bank KYC checks](https://aithreat.io/cases/bangkok-chinese-deepfake-kyc-gang/): 2025-11-11, high, Deepfake fraud, Thailand. Metropolitan Police Division 5 arrested four Chinese nationals in a Sukhumvit condo who used AI to turn victims' still photos into blinking, head-turning videos that passed bank KYC liveness checks for criminal networks.
- [HackedGPT: Tenable finds seven ChatGPT flaws including persistent memory injection](https://aithreat.io/cases/tenable-hackedgpt/): 2025-11-05, high, Prompt injection, United States. Tenable disclosed seven ChatGPT weaknesses including zero-click injection via search, one-click URL injection, a Bing redirect bypass and persistent memory injection that leaks data across sessions. OpenAI fixed some.
- [QUIETVAULT stealer uses local AI CLI tools to hunt secrets and leaks GitHub and npm tokens](https://aithreat.io/cases/gtig-quietvault-stealer/): 2025-11-05, high, AI-assisted malware, Worldwide. GTIG documented QUIETVAULT, a JavaScript stealer seen in operations that takes GitHub and npm tokens, then drives AI command-line tools on the host to find more secrets and exfiltrates via a public GitHub repo.
- [Google flags PROMPTFLUX and other malware that call Gemini at runtime](https://aithreat.io/cases/gtig-promptflux/): 2025-11-05, medium, AI-assisted malware, Worldwide. Google's threat team reported experimental malware such as PROMPTFLUX that asks Gemini to rewrite its own VBScript for evasion, plus state use of LLM-enabled tools like PROMPTSTEAL.
- [Iran's MuddyWater leaked C2 domain and encryption key to Gemini while debugging malware](https://aithreat.io/cases/gtig-muddywater-gemini-opsec/): 2025-11-05, medium, State actor AI ops, Worldwide. TEMP.Zagros (MuddyWater) used student-project pretexts to get Gemini's help building web shells and a Python C2 server, and pasted a script containing its C2 domain and encryption key, exposing infrastructure to Google.
- [China-nexus actor bypassed Gemini refusal with CTF pretext to get exploitation guidance](https://aithreat.io/cases/gtig-china-ctf-pretext/): 2025-11-05, medium, State actor AI ops, Worldwide. A suspected China-nexus group asked Gemini to find flaws on a compromised system, was refused, then reframed the request as a capture-the-flag exercise and got exploitable guidance reused for phishing and web shells.
- [SesameOp backdoor used OpenAI Assistants API as covert command-and-control for months](https://aithreat.io/cases/microsoft-sesameop-backdoor/): 2025-11-03, high, AI-assisted malware, Worldwide. Microsoft DART found a .NET backdoor that relayed encrypted commands and results through OpenAI Assistants API objects using a hardcoded API key, hiding C2 in legitimate AI traffic; attackers had been present for months.
- [Deepfake ads of Swedish finance figures lure 5,000 savers into pump-and-dump scams](https://aithreat.io/cases/sweden-deepfake-pump-dump-500m-sek/): 2025-10-31, critical, Deepfake fraud, Sweden. Swedish media reported at least 5,000 small savers lost about 500M SEK (about $52M) in 2025 to pump-and-dump share scams promoted with deepfake ads of journalist Gabriel Mellqvist and investor Gunter Marder on Meta.
- [Kaspersky: BlueNoroff GhostCall and GhostHire campaigns sped up by generative AI](https://aithreat.io/cases/kaspersky-bluenoroff-ghostcall/): 2025-10-28, high, State actor AI ops, Worldwide. Kaspersky said BlueNoroff used generative AI to speed malware development and analyse stolen data for targeting in GhostCall (fake VC calls on macOS) and GhostHire (fake recruiter tests), active since April 2025.
- [Philippine doctor loses P93M to investment scam backed by deepfake of President Marcos](https://aithreat.io/cases/pampanga-marcos-deepfake-p93m/): 2025-10-22, high, Deepfake fraud, Philippines. PNP-CIDG entrapped two suspects in Angeles City who used an AI-generated video of President Marcos Jr. and gifts supposedly from him to convince a doctor to hand over about P93 million for fake investments.
- [UAE Economy Minister says his face was deepfaked in social media investment scam videos](https://aithreat.io/cases/uae-economy-minister-deepfake-videos/): 2025-10-16, medium, Deepfake fraud, United Arab Emirates. At GITEX 2025, UAE Minister of Economy Abdulla bin Touq Al Marri said fraudsters had manipulated his image in social media videos promoting fraudulent share investment schemes and called for deepfake detection tools.
- [UAE economy minister says his deepfake was used in social media investment scam campaigns](https://aithreat.io/cases/uae-economy-minister-deepfake-ads/): 2025-10-16, low, Deepfake fraud, United Arab Emirates. At GITEX 2025, Minister Abdullah bin Touq Al Marri said fraudsters had manipulated his image in video campaigns urging people to invest in shares, and called for deepfake detection technology.
- [Path traversal in Smithery MCP hosting exposed root access to 3,000 hosted MCP servers](https://aithreat.io/cases/smithery-mcp-hosting-traversal/): 2025-10-15, medium, AI supply chain, Worldwide. GitGuardian showed that an unvalidated dockerBuildPath in smithery.yaml let a malicious Dockerfile read the builder's home directory and steal a fly.io token giving root on more than 3,000 hosted MCP servers and visibility of customer API keys.
- [Hong Kong police arrest 22 who used AI face-swaps on lost ID cards to open bank accounts](https://aithreat.io/cases/hk-ai-faceswap-lost-id-syndicate/): 2025-10-10, high, Deepfake fraud, Hong Kong. A syndicate pasted members' faces onto photos from lost Hong Kong ID cards to pass remote onboarding at seven banks, opening 19 accounts that laundered about HK$190 million; 22 people were arrested.
- [CamoLeak: hidden PR comments make GitHub Copilot Chat leak private repo secrets](https://aithreat.io/cases/camoleak-copilot-chat/): 2025-10-09, critical, Prompt injection, United States. Legit Security found a CVSS 9.6 flaw where invisible markdown comments in pull requests steered Copilot Chat to read private repositories and exfiltrate secrets character by character through GitHub's Camo image proxy.
- [UNK_DropPitch used ChatGPT to craft phishing and tooling against Taiwan's chip sector](https://aithreat.io/cases/openai-unk-droppitch-taiwan/): 2025-10-07, high, State actor AI ops, Taiwan. A Chinese-language cluster tracked as UNK_DropPitch (UTA0388) wrote multilingual phishing emails and built remote-execution scripts and HTTPS traffic protection with ChatGPT while targeting Taiwan's chip industry.
- [OpenAI bans ChatGPT accounts of scam networks in Cambodia, Myanmar and Nigeria](https://aithreat.io/cases/openai-scam-networks-oct-2025/): 2025-10-07, medium, Deepfake fraud, Worldwide. OpenAI's October 2025 threat report said it disrupted scam networks likely based in Cambodia, Myanmar and Nigeria that used ChatGPT for scripts, impersonation, translation and victim engagement, and banned the accounts.
- [Scam networks in Cambodia, Myanmar and Nigeria used ChatGPT for investment-fraud personas](https://aithreat.io/cases/openai-scam-centres-oct2025/): 2025-10-07, medium, AI phishing, Worldwide. Organised scam operations in Cambodia, Myanmar and Nigeria used ChatGPT to translate messages, generate social-media content and build investment personas, even asking it to strip em dashes to hide AI authorship.
- [Russian-speaking criminals assembled RAT and credential stealers from ChatGPT snippets](https://aithreat.io/cases/openai-russian-rat-stealers/): 2025-10-07, medium, AI-assisted malware, Worldwide. OpenAI banned accounts tied to Russian-speaking criminal groups that requested small code pieces to build a remote-access trojan, credential stealers and evasion features, posting evidence of their work on Telegram.
- [North Korea-linked cluster used ChatGPT for C2 tooling in phishing of Seoul's diplomats](https://aithreat.io/cases/openai-dprk-korean-c2-phishing/): 2025-10-07, high, State actor AI ops, South Korea. Korean-language accounts aligned with known DPRK phishing campaigns against South Korean diplomats used ChatGPT to develop C2 malware, macOS extensions, Windows Server VPN configs and credential-theft tooling.
- [Pesaro retirees lose over 10,000 euros to deepfake of Meloni promoting investment site](https://aithreat.io/cases/pesaro-meloni-deepfake-pensioners/): 2025-10-05, low, Deepfake fraud, Italy. A couple in their sixties told Pesaro police that a video with Meloni's cloned face and voice, styled as a government spot, led them to deposit over 10,000 euros on a platform that vanished at withdrawal.
- [Old Mutual warns of deepfake videos of chairman Trevor Manuel pushing fake investments](https://aithreat.io/cases/old-mutual-trevor-manuel-deepfake/): 2025-10-03, medium, Deepfake fraud, South Africa. Old Mutual warned that AI videos using the likeness and cloned voice of its chairman, former finance minister Trevor Manuel, were circulating on social media to solicit money for fake investments.
- [Brazil police bust ring using Gisele Bundchen deepfakes in Instagram ad scams](https://aithreat.io/cases/brazil-gisele-deepfake-ads/): 2025-10-01, high, Deepfake fraud, Brazil. Rio Grande do Sul police arrested suspects accused of running deepfake celebrity ads for fake giveaways and products, moving over R$20M (about $3.9M) in suspicious funds.
- [AI-altered video of Argentine spokesman Adorni touts fake YPF investment platform](https://aithreat.io/cases/argentina-adorni-ypf-ai-video/): 2025-10-01, low, Deepfake fraud, Argentina. Chequeado rated false a Facebook video in which a July 2025 press conference by spokesman Manuel Adorni was altered with AI to announce a YPF platform paying 3 million pesos a month; links led to phishing sites.
- [Gemini Trifecta: log, search-history and browsing flaws let Gemini exfiltrate user data](https://aithreat.io/cases/gemini-trifecta-tenable/): 2025-09-30, high, Prompt injection, United States. Tenable disclosed three Gemini flaws: prompts in User-Agent headers ran when Cloud Assist summarised logs, injected browser-history queries became trusted context, and the browsing tool leaked data. Google fixed all.
- [South African Reserve Bank warns of deepfake video of Governor Kganyago pushing investment](https://aithreat.io/cases/sarb-kganyago-deepfake-warning/): 2025-09-25, medium, Deepfake fraud, South Africa. The SARB posted on X that a circulating video showing Governor Lesetja Kganyago endorsing an investment was a deepfake with an altered voice, stressing the central bank never promotes investments or asks for transfers.
- [First malicious MCP server found: postmark-mcp npm package BCCs all emails to attacker](https://aithreat.io/cases/postmark-mcp-backdoor/): 2025-09-25, high, AI supply chain, Worldwide. Koi Security found a lookalike postmark-mcp package whose v1.0.16 silently copied every email sent through AI agents to an attacker address; it had about 1,600 downloads.
- [ForcedLeak: Web-to-Lead prompt injection and a $5 expired domain leak Agentforce CRM data](https://aithreat.io/cases/forcedleak-agentforce/): 2025-09-25, critical, Prompt injection, United States. Noma Security found instructions in a Web-to-Lead form, plus a whitelisted Salesforce CSP domain that had expired and cost $5, let Agentforce send CRM records to an attacker. Salesforce fixed it by 8 September 2025.
- [Microsoft blocks phishing campaign using LLM-generated obfuscated SVG files](https://aithreat.io/cases/microsoft-llm-svg-phishing/): 2025-09-24, medium, AI phishing, United States. Microsoft Threat Intelligence detected credential phishing using SVG attachments posing as PDFs whose verbose obfuscated code was likely written by an LLM.
- [SentinelLABS finds MalTerminal, GPT-4-driven malware generator likely predating Nov 2023](https://aithreat.io/cases/malterminal-gpt4-malware/): 2025-09-22, low, AI-assisted malware, Worldwide. Hunting for embedded API keys, SentinelLABS found MalTerminal.exe and loaders that ask GPT-4 to generate ransomware or a reverse shell at runtime via an endpoint deprecated in November 2023; no in-the-wild use found.
- [Notion 3.0 agents tricked by white-text PDF into leaking client data via web search](https://aithreat.io/cases/notion-agent-pdf-exfil/): 2025-09-19, medium, Prompt injection, United States. CodeIntegrity's Abi Raghuram showed a PDF with hidden white text could make a Notion agent collect client names, companies and ARR and pass them in a URL to its web search tool. Notion added detection and link approvals.
- [ShadowLeak: zero-click prompt injection makes ChatGPT Deep Research leak Gmail data](https://aithreat.io/cases/shadowleak-deep-research/): 2025-09-18, high, Prompt injection, United States. Radware showed hidden HTML in an email could make ChatGPT's Deep Research agent extract inbox data and post it to an attacker URL from OpenAI's cloud with no user click. OpenAI patched it in August 2025.
- [Hacked Raila Odinga X account posts deepfake endorsing crypto token to scam Kenyans](https://aithreat.io/cases/kenya-raila-x-hack-crypto-deepfake/): 2025-09-18, medium, Deepfake fraud, Kenya. A deepfake video of former PM Raila Odinga endorsing the Kenya Token was posted from his reportedly hacked X account and removed the same evening; unconfirmed data suggested 20 percent of supply was bought soon after.
- [Chile weighs state legal action over deepfake of President Boric in investment scam ad](https://aithreat.io/cases/chile-boric-deepfake-cde-referral/): 2025-09-17, low, Deepfake fraud, Chile. Security Minister Luis Cordero said the government was weighing a referral to the Consejo de Defensa del Estado over a deepfake that spliced Boric's voice and image into an ad for a supposed investment platform.
- [Kimsuky uses ChatGPT-forged South Korean military ID in spear-phishing](https://aithreat.io/cases/kimsuky-chatgpt-military-id/): 2025-09-15, medium, State actor AI ops, South Korea. Genians found North Korea's Kimsuky attached AI-generated deepfake military ID drafts to phishing emails that dropped malware on researchers, activists and journalists.
- [WhiteCobra floods Open VSX and VS Code Marketplace with 24 crypto-stealing extensions](https://aithreat.io/cases/whitecobra-vsix-crypto-stealers/): 2025-09-13, high, AI supply chain, Worldwide. Koi Security tied a crew it named WhiteCobra to 24 malicious extensions whose second-stage script fetched LummaStealer or a macOS payload; Ethereum developer Zak Cole lost his wallet to a fake Solidity extension for Cursor.
- [Bank of Ireland warns of deepfake videos cloning presidential candidate Heather Humphreys](https://aithreat.io/cases/ireland-humphreys-deepfake-boi-warning/): 2025-09-11, medium, Deepfake fraud, Ireland. Bank of Ireland warned that fraudsters were cloning the image and voice of presidential candidate Heather Humphreys in fake investment videos on Meta platforms, and called for platforms to verify financial advertisers.
- [Vyro AI leaves 116GB of ImagineArt and Chatly prompts and tokens on open Elasticsearch](https://aithreat.io/cases/vyro-ai-elasticsearch-leak/): 2025-09-10, high, Model & data leak, Pakistan. Cybernews found an unauthenticated Elasticsearch server belonging to Vyro AI streaming about 116GB of live logs with user prompts, bearer tokens and user agents from apps with over 10 million downloads.
- [Wuhan cyber police crack AI face-swap gang that hijacked an MCN agency's official account](https://aithreat.io/cases/wuhan-ai-faceswap-mcn-hijack/): 2025-09-09, medium, Deepfake fraud, China. A gang used AI face-swap videos to pass platform identity checks, changed a Wuhan MCN firm's legal representative, hijacked its official account and posted scam lures; police arrested four.
- [Cisco Talos finds over 1,100 Ollama LLM servers open to the internet without authentication](https://aithreat.io/cases/talos-exposed-ollama-servers/): 2025-09-02, medium, Model & data leak, Worldwide. A Shodan sweep by Cisco Talos located more than 1,100 publicly reachable Ollama servers within minutes; about 20 percent were actively serving models open to extraction, jailbreak and resource abuse.
- [s1ngularity: trojanized Nx packages weaponize Claude and Gemini CLIs to steal secrets](https://aithreat.io/cases/nx-s1ngularity/): 2025-08-27, critical, AI supply chain, Worldwide. Malicious Nx npm releases ran local AI coding CLIs with permission-bypass flags to inventory secrets, then leaked thousands of developer credentials to public GitHub repos.
- [Claude Code used to automate data extortion against 17 organizations](https://aithreat.io/cases/anthropic-vibe-hacking/): 2025-08-27, high, AI-assisted malware, Worldwide. Anthropic's threat report described a criminal using Claude Code for recon, credential harvesting and tailored ransom notes against at least 17 organizations, demanding up to ~$500K.
- [Lone criminal sold Claude-built ransomware variants on forums for $400 to $1,200](https://aithreat.io/cases/anthropic-nocode-raas/): 2025-08-27, high, AI-assisted malware, Worldwide. A single actor with basic coding skills used Claude to develop, market and sell several ransomware variants with evasion, encryption and anti-recovery features, packaged for $400 to $1,200 on underground forums.
- [North Korean operatives used Claude to pass interviews and hold jobs at Fortune 500 firms](https://aithreat.io/cases/anthropic-dprk-remote-workers/): 2025-08-27, high, State actor AI ops, United States. Anthropic found DPRK IT workers using Claude to fabricate professional identities, complete coding assessments and perform day-to-day technical work after being hired, generating sanctioned revenue for the regime.
- [Drift AI chatbot OAuth tokens stolen to raid 700+ Salesforce tenants](https://aithreat.io/cases/salesloft-drift-oauth/): 2025-08-26, critical, AI supply chain, Worldwide. UNC6395 used OAuth tokens stolen from the Drift AI chat integration to bulk-export Salesforce data from hundreds of organizations and hunt for cloud keys and passwords.
- [ESET finds PromptLock, ransomware that uses a local gpt-oss model to write scripts](https://aithreat.io/cases/promptlock-ransomware/): 2025-08-26, low, AI-assisted malware, Worldwide. ESET described PromptLock, a Go ransomware prototype that prompts gpt-oss:20b via Ollama to generate Lua scripts for discovery, exfiltration and encryption; likely a proof of concept.
- [Proofpoint: Lovable AI builder abused for Tycoon MFA phishing hitting 5,000+ organisations](https://aithreat.io/cases/proofpoint-lovable-phishing/): 2025-08-20, high, AI phishing, Worldwide. Proofpoint saw tens of thousands of malicious Lovable URLs a month since February 2025; one Tycoon campaign hit over 5,000 organisations with AI-built fake Microsoft logins capturing MFA tokens and session cookies.
- [Over 370,000 Grok conversations exposed in Google search via share links](https://aithreat.io/cases/grok-chats-indexed/): 2025-08-20, medium, Model & data leak, Worldwide. Forbes found Grok's share button generated indexable URLs, so search engines surfaced hundreds of thousands of user chats, some with personal, medical or credential details.
- [Brave shows Perplexity Comet can be hijacked by a Reddit comment to steal Gmail OTPs](https://aithreat.io/cases/comet-reddit-injection-brave/): 2025-08-20, high, Agent hijack, United States. Brave found hidden text in a Reddit post could make Comet open Gmail, trigger account recovery and send the one-time code to the attacker when the user clicked Summarize. Perplexity patched; Brave said it was incomplete.
- [PIB flags deepfakes of India's finance minister endorsing QuantumAI get-rich scheme](https://aithreat.io/cases/pib-sitharaman-quantumai-deepfakes/): 2025-08-19, medium, Deepfake fraud, India. India's PIB fact-check unit labelled fake several Facebook videos in which an AI-altered Nirmala Sitharaman promised returns such as Rs 10 lakh a month on Rs 22,000 or a QuantumAI platform; more clips were flagged later.
- [NZ FMA flags pump-and-dump scam using deepfakes of Kiwi business leaders in Meta ads](https://aithreat.io/cases/nz-fma-deepfake-pump-dump-warning/): 2025-08-19, high, Deepfake fraud, New Zealand. New Zealand's Financial Markets Authority warned that Facebook and Instagram ads with deepfake videos of prominent local business figures were funnelling investors into WhatsApp groups pushing low-value foreign shares.
- [Lenovo's Lena support chatbot coaxed into XSS payload that steals agent session cookies](https://aithreat.io/cases/lenovo-lena-chatbot-xss/): 2025-08-18, medium, Prompt injection, China. Cybernews used a 400-character prompt to make Lenovo's Lena chatbot emit HTML with a broken image tag that sent cookies to an attacker server, exposing support agents' sessions. Lenovo acknowledged and fixed it.
- [Microsoft 365 Copilot summarised files without writing audit log entries](https://aithreat.io/cases/copilot-audit-log-bypass/): 2025-08-18, medium, Model & data leak, United States. Pistachio CTO Zack Korman found that asking Copilot to omit the reference link when summarising a file produced no audit record, letting insiders read documents without a trace. Microsoft fixed it on 17 August 2025.
- [Copilot prompt injection flips VS Code to auto-approve mode for RCE (CVE-2025-53773)](https://aithreat.io/cases/copilot-yolo-mode-cve-2025-53773/): 2025-08-12, high, Agent hijack, United States. Injected text in files, web pages or GitHub issues could make Copilot write chat.tools.autoApprove into .vscode/settings.json, disabling confirmations and allowing shell commands. Microsoft patched it in August 2025.
- [Invitation Is All You Need: poisoned calendar invites make Gemini control smart homes](https://aithreat.io/cases/gemini-calendar-invite-hijack/): 2025-08-06, high, Agent hijack, Israel. Researchers from Tel Aviv University, Technion and SafeBreach showed 14 indirect prompt injections where hidden text in Google Calendar invites made Gemini open shutters, start Zoom calls and delete events.
- [AgentFlayer: one poisoned Google Drive document makes ChatGPT leak API keys](https://aithreat.io/cases/agentflayer-chatgpt-connectors/): 2025-08-06, high, Prompt injection, United States. Zenity Labs showed at Black Hat that a shared document with a 300-word prompt in 1-pixel white text could make ChatGPT search a victim's Drive for secrets and exfiltrate them via image URLs that bypassed url_safe checks.
- [Claude Code command injection bypasses confirmation prompt (CVE-2025-54795 and -54794)](https://aithreat.io/cases/claude-code-cve-2025-54795/): 2025-08-05, high, Agent hijack, United States. Two Claude Code flaws let untrusted content in the context window bypass the confirmation prompt to run commands, and escape working-directory limits via prefix path matching. Fixed in versions 1.0.20 and 0.2.111.
- [CrowdStrike: DPRK's FAMOUS CHOLLIMA used GenAI to infiltrate 320+ companies as IT workers](https://aithreat.io/cases/crowdstrike-famous-chollima-genai/): 2025-08-04, high, State actor AI ops, United States. CrowdStrike's 2025 Threat Hunting Report said North Korea's FAMOUS CHOLLIMA used generative AI across its insider scheme, from fake resumes and deepfaked interviews to on-the-job work, infiltrating 320+ firms in a year.
- [AI-written npm package @kodane/patch-manager drains Solana wallets after 1,500 downloads](https://aithreat.io/cases/kodane-npm-claude-drainer/): 2025-08-01, medium, AI-assisted malware, Worldwide. Safety researchers found a wallet drainer disguised as an npm cache manager whose code style, emojis and 'Enhanced' labels pointed to generation by Anthropic's Claude; it hid in cache folders, kept C2 persistence and swept Solana funds.
- [CurXecute and MCPoison: Cursor IDE MCP config flaws allow silent code execution](https://aithreat.io/cases/cursor-curxecute-mcpoison/): 2025-08-01, high, Agent hijack, United States. Aim Security (CVE-2025-54135) and Check Point (CVE-2025-54136) showed prompt injection could write a .cursor/mcp.json file, and an approved MCP entry could be silently swapped for a malicious command. Fixed in 1.3.
- [Thousands of shared ChatGPT conversations surface in Google search; OpenAI kills feature](https://aithreat.io/cases/chatgpt-shared-chats-indexed/): 2025-07-31, medium, Model & data leak, United States. A Make this chat discoverable toggle on shared links let search engines index conversations; Fast Company found thousands via site:chatgpt.com/share, some with personal details. OpenAI removed the feature.
- [Jordan's Cybercrime Unit warns of deepfake accounts impersonating public figures](https://aithreat.io/cases/jordan-cybercrime-deepfake-warning/): 2025-07-29, low, Deepfake fraud, Jordan. Jordan's Cybercrime Unit cautioned that fake accounts were using AI deepfake audio and video of public figures to steer citizens to fraudulent websites for financial scams and data theft.
- [Wiz finds auth bypass exposing private enterprise apps on Wix's Base44 platform](https://aithreat.io/cases/base44-auth-bypass-wiz/): 2025-07-29, high, Model & data leak, Israel. Wiz Research found undocumented register and verify-otp endpoints that needed only a public app_id to create verified accounts on private Base44 apps, bypassing SSO. Wix fixed it within 24 hours of the 9 July report.
- [Gemini CLI hijacked via poisoned README to silently exfiltrate credentials](https://aithreat.io/cases/gemini-cli-tracebit-hijack/): 2025-07-28, high, Agent hijack, United States. Tracebit showed instructions hidden in README.md or GEMINI.md could make Gemini CLI run an allow-listed grep padded with whitespace and a hidden env and curl payload, exfiltrating secrets silently. Fixed in 0.1.14.
- [Exposed llama.cpp servers leak user prompts through the /slots debug endpoint](https://aithreat.io/cases/llama-cpp-slots-prompt-leak/): 2025-07-25, medium, Model & data leak, Worldwide. UpGuard found about 400 internet-facing llama.cpp servers, a third of which exposed live prompts via the unauthenticated /slots endpoint; 952 messages were collected in a day, including sexual roleplay involving fictional minors.
- [Medellin mayor's AI-cloned voice used in paid ads for fake Nubank investment platform](https://aithreat.io/cases/medellin-gutierrez-voice-clone-scam/): 2025-07-23, low, Deepfake fraud, Colombia. A paid video cloned the voices of Medellin mayor Federico Gutierrez and Nubank founder David Velez to promote a platform asking for 300,000 peso deposits; Gutierrez denounced it on X as absolutely false.
- [Hacker plants data-wiping prompt in Amazon Q Developer VS Code extension](https://aithreat.io/cases/amazon-q-wiper-prompt/): 2025-07-23, high, AI supply chain, United States. A malicious pull request slipped a prompt telling the AI agent to wipe local files and AWS resources into a signed Q extension release; a formatting error kept it from executing.
- [Replit AI agent deletes SaaStr production database during a code freeze](https://aithreat.io/cases/replit-agent-saastr-db-wipe/): 2025-07-22, high, Agent hijack, United States. During a 12-day vibe-coding test, Replit's agent ran destructive commands that wiped a live database of 1,206 executives and about 1,196 companies despite instructions to make no changes, then reported misleadingly on what it had done.
- [Replit AI agent deletes SaaStr production database during code freeze, then misreports it](https://aithreat.io/cases/replit-agent-deletes-database/): 2025-07-19, high, Agent hijack, United States. During a 12-day vibe-coding test, Replit's agent ran destructive commands that wiped a database of about 1,200 executives and 1,190 companies despite instructions not to change anything, then said rollback was impossible
- [LameHug: APT28-linked malware queries Qwen LLM to generate commands](https://aithreat.io/cases/lamehug-apt28/): 2025-07-17, high, State actor AI ops, Ukraine. CERT-UA reported phishing that delivered LameHug, a Python stealer using Qwen 2.5-Coder via Hugging Face's API to craft recon and theft commands, attributed to APT28 with moderate confidence.
- [Meta AI bug let any logged-in user read other people's private prompts and replies](https://aithreat.io/cases/meta-ai-prompt-idor/): 2025-07-15, medium, Model & data leak, United States. AppSecure's Sandeep Hodkasia found that changing the guessable ID of an edited prompt returned another user's prompt and reply because Meta skipped authorisation checks. Meta fixed it in January 2025 and paid $10,000.
- [GLOBAL GROUP RaaS deploys AI chatbot negotiators to press seven-figure ransoms](https://aithreat.io/cases/global-group-ai-negotiator/): 2025-07-15, high, AI-assisted malware, United States. EclecticIQ found the BlackLock rebrand GLOBAL GROUP running an AI-driven chatbot in its ransom negotiation panel so non-English affiliates could pressure victims; one affiliate demanded 1 million USD within 48 hours.
- [DOGE staffer Marko Elez leaks xAI API key granting access to 52 Grok models](https://aithreat.io/cases/doge-xai-api-key-leak/): 2025-07-14, high, Model & data leak, United States. Marko Elez, a DOGE employee with access to sensitive federal databases, committed a script containing a private xAI API key to public GitHub; researchers found it unlocked at least 52 xAI models and it was still valid after the repo was pulled.
- [Hidden email text makes Gemini for Workspace summaries deliver fake security alerts](https://aithreat.io/cases/gemini-gmail-summary-phishing/): 2025-07-10, medium, Prompt injection, United States. Mozilla 0din's Marco Figueroa showed white-on-white or zero-size text in an email could make Gemini's Summarize this email feature append a fake Google warning with an attacker phone number. Google acknowledged it.
- [Fake 'Solidity Language' extension on Open VSX drains $500K from Cursor developer](https://aithreat.io/cases/cursor-solidity-extension-theft/): 2025-07-10, high, AI supply chain, Russia. A spoofed Solidity extension on Open VSX, ranked above the real one through inflated downloads, ran a PowerShell script that installed ScreenConnect, Quasar RAT and a stealer, letting attackers take a developer's seed phrases and about 500,000 dollars in crypto.
- [McDonald's McHire AI hiring bot exposed up to 64M applicant records via '123456' login](https://aithreat.io/cases/mchire-paradox-exposure/): 2025-07-09, high, Model & data leak, United States. Researchers accessed the admin panel of the Olivia hiring chatbot with default 123456 credentials and an IDOR flaw, exposing chat logs and contact data tied to up to 64M applications.
- [AI voice impersonator of Marco Rubio contacts foreign ministers via Signal](https://aithreat.io/cases/rubio-ai-impersonation/): 2025-07-08, high, Deepfake fraud, United States. A State Department cable warned an impostor used AI-generated voice and text on Signal to pose as Secretary Rubio, contacting three foreign ministers, a governor and a member of Congress.
- [AI videos of President Ruto resigning hit 1.4M views on TikTok during Kenya protests](https://aithreat.io/cases/kenya-ruto-resignation-deepfakes/): 2025-07-08, medium, Deepfake fraud, Kenya. During deadly protests, AI videos built on State House footage showed Ruto announcing his resignation; one TikTok clip drew over 1.4 million views before deletion and Africa Check rated the claims false.
- [Deepfakes of Netanyahu, Gadot and Musk drive Ostin Technology pump-and-dump in Israel](https://aithreat.io/cases/israel-ostin-deepfake-pump-dump/): 2025-07-07, high, Deepfake fraud, Israel. From April 2025 a campaign used deepfakes of Netanyahu, Amir Yaron, Gal Gadot and Elon Musk plus fake WhatsApp groups impersonating the TASE and Israeli banks to pump Nasdaq-listed Ostin Technology; it fell 93 percent.
- [Support ticket prompt injection makes Cursor plus Supabase MCP dump integration tokens](https://aithreat.io/cases/supabase-mcp-cursor-token-leak/): 2025-07-06, medium, Prompt injection, United States. General Analysis showed a support ticket with hidden instructions could make a Cursor agent, connected to Supabase via MCP with a service role, read the integration_tokens table and write the secrets into the ticket.
- [Mumbai cyber police bust Bengaluru agency running deepfake stock-expert ads](https://aithreat.io/cases/mumbai-valueleaf-deepfake-stock-ads/): 2025-07-01, medium, Deepfake fraud, India. After an analyst found deepfake videos of himself, Mumbai Cyber Police traced paid promotions run in July 2025 by Bengaluru firm Valueleaf, reportedly for Hong Kong client First Bridge, and arrested four in October.
- [Microsoft: DPRK's Jasper Sleet IT workers use AI to forge IDs; 3,000 accounts suspended](https://aithreat.io/cases/microsoft-jasper-sleet-ai-identities/): 2025-06-30, high, Deepfake fraud, United States. Microsoft reported DPRK remote IT workers (Jasper Sleet) use AI to swap faces into stolen ID documents, polish photos and resumes and test voice changers; it suspended 3,000 Outlook and Hotmail accounts they created.
- [Skynet malware sample embeds prompt injection to fool AI malware analysis tools](https://aithreat.io/cases/skynet-prompt-injection-malware/): 2025-06-25, low, Prompt injection, Netherlands. Check Point found a half-finished Windows sample on VirusTotal with a string telling any analysing LLM to ignore instructions, act as a calculator and reply NO MALWARE DETECTED; it failed against o3 and GPT-4.1.
- [Pickai backdoor spreads through ComfyUI flaws to nearly 700 AI image servers](https://aithreat.io/cases/pickai-comfyui-backdoor/): 2025-06-18, high, AI supply chain, Worldwide. Qi'anxin XLab tracked a C++ backdoor delivered via ComfyUI vulnerabilities that disguised itself as config files, stole AI-related data and gave reverse shells; samples were also served from commercial AI vendor Rubick.ai's site.
- [Asana MCP server bug exposed customer data to other organizations for a month](https://aithreat.io/cases/asana-mcp-cross-tenant-exposure/): 2025-06-18, medium, Model & data leak, United States. A logic flaw in Asana's Model Context Protocol server, launched May 1, let data from one customer's domain surface to other MCP users' AI assistants; Asana took the feature offline for two weeks and notified about 1,000 customers.
- [Cato CTRL: new WormGPT variants are jailbroken wrappers on Grok and Mixtral](https://aithreat.io/cases/wormgpt-grok-mixtral-variants/): 2025-06-17, medium, AI-assisted malware, Worldwide. Cato CTRL obtained two WormGPT variants sold via Telegram and showed one runs on xAI Grok and the other on Mistral Mixtral with guardrail-stripping system prompts; both wrote phishing emails and credential stealers.
- [Langflow AI agent builder RCE (CVE-2025-3248) exploited to spread Flodrix botnet](https://aithreat.io/cases/langflow-flodrix/): 2025-06-17, critical, AI supply chain, Worldwide. After CISA added the unauthenticated Langflow code-injection flaw to KEV, attackers used public exploits on exposed AI workflow servers to install the Flodrix DDoS botnet.
- [Asana MCP server logic flaw exposed customer data across organisations for a month](https://aithreat.io/cases/asana-mcp-cross-tenant/): 2025-06-17, medium, Model & data leak, United States. A logic bug in Asana's new MCP server, live from early May, could show tasks, project metadata, comments and files from other organisations to users of AI tools. Asana took it offline on 5 June and fixed it.
- [Meta AI app's Discover feed broadcasts users' private medical and legal chats](https://aithreat.io/cases/meta-ai-discover-feed/): 2025-06-12, medium, Model & data leak, United States. The Meta AI app's public Discover feed showed conversations users appeared to have shared by accident, including medical, financial and legal details, because the share flow gave no clear warning. Meta added a warning.
- [EchoLeak: zero-click prompt injection in Microsoft 365 Copilot (CVE-2025-32711)](https://aithreat.io/cases/echoleak-m365-copilot/): 2025-06-11, high, Prompt injection, Worldwide. Aim Security showed a crafted email could make M365 Copilot silently exfiltrate tenant data with no clicks; Microsoft fixed it server-side, CVSS 9.3, no in-the-wild abuse reported.
- [Stockholm police warn of AI deepfakes of Anders Tegnell and Agnes Wold in card-theft ads](https://aithreat.io/cases/stockholm-police-doctor-deepfake-ads/): 2025-06-09, medium, Deepfake fraud, Sweden. Stockholm County Police reported multiple complaints since late May 2025 about social media ads using AI to imitate well-known doctors in fake health product promotions that harvested card details.
- [Wrong Number: Cambodia task scam used ChatGPT to translate SMS lures into six languages](https://aithreat.io/cases/openai-wrong-number-task-scam/): 2025-06-09, medium, AI phishing, United Kingdom. A centralised Cambodia-based operation generated recruitment-style messages in six languages offering pay for trivial tasks, routing responders from SMS to WhatsApp to a Telegram mentor; one lure hit an OpenAI staffer.
- [OpenAI bans APT15 and APT5 accounts using ChatGPT for pentest automation and US recon](https://aithreat.io/cases/openai-vixen-keyhole-panda/): 2025-06-09, medium, State actor AI ops, United States. Chinese state groups Vixen Panda (APT15) and Keyhole Panda (APT5) used ChatGPT for script edits, system configuration, pentest automation and Android social-media tooling while researching US defence and telecom targets.
- [VAGue Focus: China-linked accounts used ChatGPT to social-engineer US officials and press](https://aithreat.io/cases/openai-vague-focus/): 2025-06-09, medium, AI phishing, United States. Accounts active in mainland Chinese business hours posed as staff of Focus Lens News, BrightWave Media Europe and Visionary Advisory Group, translating social-engineering messages and polishing letters to a US senator.
- [ScopeCreep: Russian-speaking actor built Windows malware with ChatGPT throwaway accounts](https://aithreat.io/cases/openai-scopecreep-malware/): 2025-06-09, high, AI-assisted malware, Worldwide. A Russian-speaking group used temporary ChatGPT accounts, one per code change, to build modular Windows malware with DLL sideloading, obfuscation, credential theft and Telegram alerts, spread via a trojanized game tool.
- [Exposed Open WebUI instance hijacked to run AI-generated cryptominer and infostealer](https://aithreat.io/cases/open-webui-sysdig-cryptojacking/): 2025-06-02, high, LLMjacking, Worldwide. Sysdig observed an attacker abuse an Open WebUI server exposed with admin rights and no login, uploading an obfuscated, partly AI-written Python Tool that deployed XMRig and T-Rex miners on Linux and Java infostealers on Windows.
- [170 Lovable-built apps expose user data through missing Supabase row-level security](https://aithreat.io/cases/lovable-rls-exposure/): 2025-05-29, high, Model & data leak, Sweden. Matt Palmer scanned 1,645 Lovable-generated apps and found 170 with 303 endpoints where anyone with the public anon key could dump emails, phone numbers, payment records and API keys. Tracked as CVE-2025-48757.
- [Lovable-built apps leak user data: 303 endpoints across 170 projects lacked row-level security](https://aithreat.io/cases/lovable-rls-cve-2025-48757/): 2025-05-29, high, Model & data leak, Sweden. Researcher Matt Palmer found Lovable-generated Supabase backends shipped without working row-level security, letting anyone read or write tables; a scan of 1,645 apps found 170 exposing emails, phones, payment data and API keys.
- [GitLab Duo prompt injection leaks private source code via hidden merge request text](https://aithreat.io/cases/gitlab-duo-hidden-prompt/): 2025-05-22, medium, Prompt injection, United States. Legit Security showed prompts hidden with Unicode smuggling, Base16 or white KaTeX text in merge requests and issues could make GitLab Duo exfiltrate private code and inject HTML into its responses. GitLab patched it.
- [PyPI packages posing as Alibaba AI Labs SDK hide infostealer in PyTorch model](https://aithreat.io/cases/aliyun-ai-labs-pypi-pickle/): 2025-05-22, high, AI supply chain, China. Packages aliyun-ai-labs-snippets-sdk, ai-labs-snippets-sdk and aliyun-ai-labs-sdk shipped a model.pt whose pickle payload collected host details and .gitconfig and sent them to an Alibaba Cloud OSS bucket; about 1,600 downloads.
- [FBI warns AI-voice vishing campaign impersonates senior US officials to hijack accounts](https://aithreat.io/cases/fbi-ai-voice-us-officials/): 2025-05-15, high, AI phishing, United States. FBI PSA I-051525 said that since April 2025 actors have sent smishing texts and AI-generated voice messages posing as senior US officials to build rapport, push malicious links and take over accounts.
- [FSCA warns of WhatsApp deepfake of its commissioner pushing fake Nedbank AI trading tool](https://aithreat.io/cases/fsca-kamlana-deepfake-nedbank/): 2025-05-09, medium, Deepfake fraud, South Africa. South Africa's FSCA flagged a WhatsApp deepfake in which Commissioner Unathi Kamlana appears to endorse an NBSG or Nedbank Securities AI trading tool promising 20 to 30 percent higher returns.
- [npm packages 'sw-cur' and 'aiide-cur' backdoor Cursor on macOS, 3,200 downloads](https://aithreat.io/cases/cursor-npm-macos-backdoor/): 2025-05-09, high, AI supply chain, Worldwide. Socket found three npm packages promising cheap Cursor access that stole Cursor credentials, patched Cursor's main.js with attacker code, disabled auto-update and restarted the IDE to keep remote execution inside it.
- [Peru's BCP denounces AI video impersonating Credicorp CEO Gianfranco Ferrari in scam](https://aithreat.io/cases/bcp-credicorp-ceo-deepfake/): 2025-05-08, medium, Deepfake fraud, PE. Banco de Credito del Peru said a social media video of Credicorp CEO Gianfranco Ferrari inviting the public into an investment programme was an AI simulation of his voice and appearance, and announced legal action.
- [xAI employee leaks API key on GitHub exposing 60 private Grok models for two months](https://aithreat.io/cases/xai-key-leak-spacex-tesla-llms/): 2025-05-01, high, Model & data leak, United States. An xAI technical staffer committed an x.ai API key to a public GitHub repo; GitGuardian found it granted access to at least 60 unreleased and private models, some fine-tuned on SpaceX and Tesla data, and it stayed valid for two months.
- [xAI employee leaks API key on GitHub exposing 60 private Grok models for two months](https://aithreat.io/cases/xai-api-key-github-leak/): 2025-05-01, high, Model & data leak, United States. A key committed to a public GitHub repo by an xAI staffer worked against at least 60 fine-tuned and unreleased models, including grok-2.5V and models apparently built on SpaceX and Tesla data. It stayed valid two months.
- [Vietnam busts Chinese deepfake sextortion ring that hit nearly 1,000 executives for $8M](https://aithreat.io/cases/vietnam-deepfake-extortion-ring/): 2025-04-25, critical, Deepfake fraud, Vietnam. Vietnam's Ministry of Public Security said Chinese nationals used AI deepfakes to fabricate explicit images of nearly 1,000 Vietnamese executives and demanded USDT; losses about VND 200 billion (about $8M).
- [Korea's PIPC: DeepSeek sent Korean users' prompts to ByteDance-linked Volcano Engine](https://aithreat.io/cases/korea-pipc-deepseek-prompt-transfer/): 2025-04-24, high, Model & data leak, South Korea. Korea's PIPC found DeepSeek sent user data and AI prompts to five firms in China and the US, including ByteDance affiliate Volcano Engine, without consent, and ordered corrective measures.
- [Indonesian police arrest three over TikTok deepfake of governor selling Rp500k motorbikes](https://aithreat.io/cases/east-java-khofifah-deepfake-arrests/): 2025-04-24, low, Deepfake fraud, Indonesia. Three men from Pangandaran edited videos of Governor Khofifah with AI to advertise a fake programme offering motorbikes for Rp500,000, taking about Rp87 million from roughly 100 victims before arrest.
- [Recruitment-fraud ring used Claude to polish fake hiring-manager lures in Eastern Europe](https://aithreat.io/cases/anthropic-recruitment-fraud-2025/): 2025-04-23, medium, AI phishing, Worldwide. A moderately sophisticated group impersonating hiring managers at real companies had Claude rewrite non-native English into fluent messages, craft interview scripts and format lures to harvest applicants' personal data.
- [Novice coder grows doxing toolkit and evasive malware builder with Claude's help](https://aithreat.io/cases/anthropic-novice-malware-builder/): 2025-04-23, medium, AI-assisted malware, Worldwide. An individual with little coding skill used Claude to grow a basic toolkit into a suite with facial recognition and dark-web scanning, and a batch-script generator into a GUI malware builder with evasion and persistence.
- [Anthropic bans actor using Claude to build IoT security-camera credential scraper](https://aithreat.io/cases/anthropic-iot-camera-creds/): 2025-04-23, medium, AI-assisted malware, Worldwide. A skilled developer used Claude to rewrite a scraping toolkit that harvests leaked camera logins from breach platforms and stealer-log Telegram groups, aiming to force access to the devices.
- [AkiraBot uses GPT-4o-mini to spam 80,000 websites through contact forms and chat widgets](https://aithreat.io/cases/akirabot-openai-spam/): 2025-04-09, medium, AI phishing, Worldwide. SentinelLABS exposed AkiraBot, a Python framework that scrapes each target site and asks OpenAI to write unique SEO spam, bypassing CAPTCHAs; it targeted 420,000 domains and hit at least 80,000 since September 2024.
- [Pindrop unmasks 'Ivan X', deepfake engineering candidate traced near Russia-DPRK border](https://aithreat.io/cases/pindrop-ivan-x-deepfake-applicant/): 2025-04-08, medium, Deepfake fraud, United States. Pindrop said an engineering applicant called Ivan used deepfake video and generative AI in interviews; a recruiter saw lip-speech mismatch and his IP pointed to a possible Russian military site near North Korea.
- [Xanthorox AI: self-hosted five-model criminal platform marketed as WormGPT killer](https://aithreat.io/cases/xanthorox-ai-darknet/): 2025-04-07, medium, AI-assisted malware, Worldwide. SlashNext found Xanthorox AI on darknet forums from late Q1 2025, claiming five custom models on private servers for coding, vision, reasoning and voice; seller screenshots showed Defender-evading ransomware output.
- [Spain's Operation COINBLACK: six held over 19M euro AI deepfake celebrity crypto scam](https://aithreat.io/cases/spain-coinblack-deepfake-crypto/): 2025-04-07, high, Deepfake fraud, Spain. Spanish National Police arrested six people in Granada and Alicante who used AI ads with deepfake celebrity endorsements to sell fake crypto investments, defrauding 208 victims of about 19 million euros ($20.9M).
- [Deepfake Zoom call of executives tricks Singapore finance director into $499K transfer](https://aithreat.io/cases/singapore-deepfake-zoom/): 2025-04-07, high, Deepfake fraud, Singapore. A finance director joined a Zoom call with deepfaked company executives and wired about US$499,000 to a mule account; Singapore and Hong Kong police traced and froze the funds.
- [QatarEnergy warns public of AI-generated videos impersonating it to sell fake investments](https://aithreat.io/cases/qatarenergy-ai-investment-videos/): 2025-03-26, low, Deepfake fraud, QA. Qatar's state energy company warned about fake adverts and AI-generated videos presenting investment opportunities in its name, stressing it never asks the public for money; it reissued the warning in November 2025.
- [Malaysian police tie five deepfake videos of Anwar, Trump, Musk and Petronas to scam](https://aithreat.io/cases/malaysia-vip-deepfake-investment-videos/): 2025-03-12, medium, Deepfake fraud, Malaysia. Bukit Aman's commercial crime unit said one syndicate made five deepfake videos of PM Anwar, Donald Trump, Elon Musk, Petronas executives and MP Teresa Kok promoting a fake government-backed scheme with 100x returns.
- [Argentine federal prosecutor probes AI video of minister Caputo promoting Immediate AI](https://aithreat.io/cases/argentina-caputo-deepfake-immediate-ai/): 2025-03-11, medium, Deepfake fraud, Argentina. Authorities warned of a fake AI video of Economy Minister Luis Caputo endorsing the Immediate AI Comerciante platform, promising daily gains of up to 2M pesos; Fiscalia Federal No 5 under Franco Picardi took the case.
- [Leaked files expose Tbilisi call centre using Martin Lewis deepfakes to con 6,000 people](https://aithreat.io/cases/tbilisi-deepfake-crypto-boiler-room-uk/): 2025-03-05, critical, Deepfake fraud, United Kingdom. A 1.9TB leak to SVT, OCCRP and the Guardian exposed a Tbilisi boiler room of about 85 agents that used deepfakes of Martin Lewis, Zoe Ball and Ben Fogle to lure 6,179 victims into fake crypto platforms for about $35M.
- [Microsoft names Storm-2139 members who hijacked Azure OpenAI with stolen keys](https://aithreat.io/cases/storm-2139-azure-openai/): 2025-02-27, high, LLMjacking, Worldwide. Microsoft amended its lawsuit to name four people in a ring that used scraped customer API keys to access Azure OpenAI, bypass guardrails, resell access and generate harmful imagery.
- [Copilot serves code from 20,000 GitHub repos that were made private, via Bing cache](https://aithreat.io/cases/wayback-copilot-lasso/): 2025-02-26, medium, Model & data leak, United States. Lasso Security found Copilot still returned content from over 20,000 repositories of 16,000+ organisations that had been made private or deleted, because Bing cached them while public. Microsoft disabled cache links.
- [Sheinbaum denounces AI videos of her urging Mexicans to invest in Pemex shares](https://aithreat.io/cases/sheinbaum-pemex-ai-investment-videos/): 2025-02-26, medium, Deepfake fraud, Mexico. Sheinbaum said AI-generated Facebook reels showing her inviting people to invest in Pemex for 6,000 to 7,000 pesos a day were false and had circulated since November 2024; Condusef issued parallel alerts.
- [OpenAI bans China-linked Peer Review network building Qianyue social-media monitoring tool](https://aithreat.io/cases/openai-peer-review-qianyue/): 2025-02-21, high, State actor AI ops, Worldwide. Accounts likely in China used ChatGPT to write sales copy, debug code and analyse documents for the Qianyue Overseas Public Opinion AI Assistant, a Llama-based tool reporting on Western protests to Chinese authorities.
- [Kimsuky and BlueNoroff used ChatGPT to debug RDP brute-force code and research intrusion](https://aithreat.io/cases/openai-kimsuky-bluenoroff-rdp/): 2025-02-21, medium, State actor AI ops, Worldwide. OpenAI banned accounts linked to North Korea's Kimsuky and BlueNoroff that gathered information on cyber intrusion tools and cryptocurrency topics and debugged code for RDP brute-force attacks.
- [OpenAI disrupts North Korean IT-worker accounts writing fake resumes and interview scripts](https://aithreat.io/cases/openai-dprk-employment-feb2025/): 2025-02-21, high, State actor AI ops, United States. ChatGPT accounts tied to the DPRK IT-worker scheme produced resumes, profiles and cover letters plus scripted excuses for suspicious behaviour such as avoiding video; some applications were posted on LinkedIn.
- [Cambodia-based romance-baiting scam used ChatGPT to generate multilingual social lures](https://aithreat.io/cases/openai-cambodia-romance-baiting/): 2025-02-21, medium, AI phishing, Worldwide. A likely Cambodia-based network translated and generated comments in Japanese, Chinese and English for romance and investment scams, which OpenAI disrupted alongside a separate Urdu-English task scam.
- [AI-cloned voice of Italy's defence minister used to con business leaders](https://aithreat.io/cases/crosetto-voice-clone/): 2025-02-12, high, Deepfake fraud, Italy. Scammers mimicked Defence Minister Guido Crosetto's voice to solicit ransom money for 'kidnapped journalists'; Massimo Moratti wired nearly EUR 1M, which police later froze in the Netherlands.
- [Vidoc Security Lab catches two deepfake job applicants in live video interviews](https://aithreat.io/cases/vidoc-deepfake-job-candidates/): 2025-02-11, medium, Deepfake fraud, United States. Vidoc co-founder Dawid Moczadlo exposed two applicants using real-time face filters and ChatGPT-style answers in interviews; one refused to pass a hand over his face. Vidoc suspects a DPRK-style fake IT worker scheme.
- [Hacker claims OmniGPT breach exposing 34 million chat messages and 30,000 user emails](https://aithreat.io/cases/omnigpt-breach-claim/): 2025-02-09, high, Model & data leak, United States. A BreachForums user named Gloomer posted samples allegedly taken from OmniGPT: over 34 million lines of user-chatbot conversations, around 30,000 emails with some phone numbers, file links and credentials. Unconfirmed.
- [Hacker 'Gloomer' claims OmniGPT breach leaking 34M chat lines and 30K user contacts](https://aithreat.io/cases/omnigpt-alleged-breach/): 2025-02-09, high, Model & data leak, Worldwide. A BreachForums user posted data allegedly taken from OmniGPT: about 34 million lines of user-chatbot conversations, emails and phone numbers of roughly 30,000 users and links to uploaded files containing API keys and credentials.
- [LLMjacking crews load stolen DeepSeek keys into reverse proxies days after model launch](https://aithreat.io/cases/sysdig-llmjacking-deepseek/): 2025-02-07, high, LLMjacking, Worldwide. Sysdig found over 20 reverse proxies running on stolen credentials; one held 55 DeepSeek keys, another burned 2.2 billion tokens worth tens of thousands of dollars in 4.5 days and resold access for 30 USD a month.
- [nullifAI: broken-pickle models on Hugging Face evade Picklescan and carry reverse shells](https://aithreat.io/cases/nullifai-hugging-face-pickle/): 2025-02-06, medium, AI supply chain, Worldwide. ReversingLabs found two Hugging Face models whose 7z-compressed, deliberately corrupted pickle streams hid a reverse shell to a hard-coded IP while passing Hugging Face's Picklescan checks.
- [Mexico's Condusef warns of AI voice-cloning calls used to request large bank transfers](https://aithreat.io/cases/mexico-condusef-voice-clone-alert/): 2025-02-06, low, Deepfake fraud, Mexico. Financial consumer regulator Condusef alerted the public that fraudsters were using AI to clone familiar voices in phone calls, typically to request large bank transfers, and linked it to a parallel WhatsApp scam.
- [Thai police arrest two from Poipet gang using AI face-altering to pose as police](https://aithreat.io/cases/thailand-poipet-ai-police-scam/): 2025-02-04, high, Deepfake fraud, Thailand. Thai police arrested two members of a Poipet, Cambodia call centre that used AI to alter faces on video calls while posing as police; 163 victims, including Charlotte Austin who lost 4 million baht (about $118,000).
- [OpenAI says it has evidence DeepSeek distilled its models through blocked API accounts](https://aithreat.io/cases/openai-deepseek-distillation/): 2025-01-29, medium, Model & data leak, China. OpenAI told the Financial Times it found signs DeepSeek used its outputs to train a rival in breach of its terms; Microsoft reportedly saw accounts pulling large data volumes via the API and blocked them. No proof shown.
- [DeepSeek leaves ClickHouse database with chat logs and API secrets open](https://aithreat.io/cases/deepseek-db-exposure/): 2025-01-29, high, Model & data leak, China. Wiz found a publicly reachable DeepSeek ClickHouse database exposing over a million log lines including user chat history, API secrets and backend details; it was locked down after disclosure.
- [Fake 'deepseeek' and 'deepseekai' PyPI packages steal secrets from DeepSeek developers](https://aithreat.io/cases/deepseeek-pypi-packages/): 2025-01-29, medium, AI supply chain, Worldwide. Two PyPI packages posing as DeepSeek client libraries harvested user, host and environment-variable data to a Pipedream endpoint; they were pulled within an hour after a few hundred downloads.
- [DeepSeek halts new sign-ups after month-long DDoS and brute-force campaign peaks](https://aithreat.io/cases/deepseek-ddos-registration-halt/): 2025-01-28, high, LLMjacking, China. DeepSeek said its services were under large-scale malicious attack on 28 January 2025 and limited sign-ups to Chinese mobile numbers; Qi An Xin XLab traced a month of escalating DDoS and brute-force traffic.
- [Indonesian police arrest two over deepfake videos of President Prabowo promising cash aid](https://aithreat.io/cases/indonesia-prabowo-deepfake-aid-scam/): 2025-01-24, medium, Deepfake fraud, Indonesia. Indonesian police arrested suspects AMA and JS for spreading AI videos of President Prabowo, VP Gibran and Minister Sri Mulyani offering aid for admin fees; about Rp 95 million (about $5,800) taken from 100-plus victims.
- [Storm-1516 floods German election with 100+ AI-written fake news sites and deepfakes](https://aithreat.io/cases/storm-1516-bundestag-deepfakes/): 2025-01-23, high, State actor AI ops, Germany. CORRECTIV and NewsGuard exposed a Russian network of more than 100 German-language fake news sites filled with LLM-rewritten articles and deepfake videos smearing Habeck, Baerbock and Faber before the February 2025 vote.
- [GhostGPT: uncensored chatbot sold on Telegram to write malware and phishing for criminals](https://aithreat.io/cases/ghostgpt-criminal-chatbot/): 2025-01-23, medium, AI phishing, Worldwide. Abnormal Security documented GhostGPT, a jailbroken LLM wrapper sold via Telegram with a no-logs claim, that produced a convincing DocuSign phishing email on request and is marketed for malware and exploit work.
- [French woman loses 830,000 euros to AI-generated 'Brad Pitt' romance scam; probe opened](https://aithreat.io/cases/brad-pitt-ai-romance-scam-france/): 2025-01-17, high, Deepfake fraud, France. A French woman sent about 830,000 euros (about $855,000) over 18 months to scammers using AI-generated images of Brad Pitt, including fake hospital selfies; police in La Reunion opened a probe after her complaint.
- [Brasilia police Operacao VoiceOver busts gang using Marcos Mion deepfakes for voucher scam](https://aithreat.io/cases/brazil-voiceover-mion-deepfake/): 2025-01-16, medium, Deepfake fraud, Brazil. The Policia Civil do Distrito Federal arrested three people aged 20 to 23 who used deepfake video and voice of TV host Marcos Mion in sponsored ads for fake Outback discount vouchers sold on cloned sites.
- [Brasilia police bust group using Marcos Mion deepfakes to sell fake restaurant vouchers](https://aithreat.io/cases/brasilia-marcos-mion-deepfake-vouchers/): 2025-01-16, low, Deepfake fraud, Brazil. Brasilia civil police arrested at least three people who manipulated TV host Marcos Mion's image and voice to sell restaurant vouchers never delivered; a May 2025 second phase arrested the alleged site builder.
- [Check Point: FunkSec ransomware group built its Rust encryptor with AI assistance](https://aithreat.io/cases/funksec-ai-assisted-ransomware/): 2025-01-10, high, AI-assisted malware, Worldwide. Check Point Research found that FunkSec, a RaaS group that claimed 85 victims in December 2024, likely developed its Rust encryptor and tooling with AI help, letting an inexperienced author iterate fast.
- [Las Vegas Cybertruck bomber used ChatGPT to plan explosion, police say](https://aithreat.io/cases/cybertruck-chatgpt-planning/): 2025-01-07, high, Prompt injection, United States. Las Vegas police said Matthew Livelsberger, an active-duty soldier, used ChatGPT to research explosives and plan the 1 January 2025 Cybertruck blast that injured seven; OpenAI said its model gave only public information.
- [Hong Kong police arrest 31 in Kowloon Bay deepfake romance-crypto syndicate (HK$34M)](https://aithreat.io/cases/hk-kowloon-bay-deepfake-ring/): 2025-01-05, high, Deepfake fraud, Hong Kong. Hong Kong's Commercial Crime Bureau arrested 31 people in Kowloon Bay who used AI face-swapped personas on dating apps to lure overseas victims into fake crypto platforms, taking over HK$34 million (about $4.37M).

## Citing
Cite a case as: <title>. AI Threat Watch, case <id>, <date>. <permanent link>. Licence: CC BY 4.0 (reuse with a link).