GOOGLE REPORTS STATE-BACKED HACKERS USING GEMINI AI FOR RECON AND ATTACK SUPPORT

Summary from the TLDR InfoSec newsletter

Google's threat team details how North Korean group UNC2970 and others weaponize Gemini for OSINT-driven target profiling, tailored phishing, vulnerability analysis, and exploit debugging, blurring the line between research and reconnaissance. Attackers also use Gemini's API in HONESTCUE malware, AI-built COINBAIT phishing kits, and large-scale model extraction attempts that clone Gemini's behavior via high-volume prompt queries.