1、2025 NovemberGTIG AI Threat Tracker:Advances in Threat Actor Usage of AI Tools 1Based on recent analysis of the broader threat landscape,Google Threat Intelligence Group(GTIG)has identified a shift that occurred within the last year:adversaries are no longer leveraging artificial intelligence(AI)jus

2、t for productivity gains,they are deploying novel AI-enabled malware in active operations.This marks a new operational phase of AI abuse,involving tools that dynamically alter behavior mid-execution.This report serves as an update to our January 2025 analysis,Adversarial Misuse of Generative AI,and

3、details how government-backed threat actors and cyber criminals are integrating and experimenting with AI across the industry throughout the entire attack lifecycle.Our findings are based on the broader threat landscape.At Google,we are committed to developing AI responsibly and take proactive steps

4、 to disrupt malicious activity by disabling the projects and accounts associated with bad actors,while continuously improving our models to make them less susceptible to misuse.We also proactively share industry best practices to arm defenders and enable stronger protections across the ecosystem.Thr

5、oughout this report weve noted steps weve taken to thwart malicious activity,including disabling assets and applying intel to strengthen both our classifiers and model so its protected from misuse moving forward.Additional details on how were protecting and defending Gemini can be found in this whit

6、e paper,“Advancing Geminis Security Safeguards.”Executive Summary2Key Findings:First Use of Just-in-Time AI in Malware:For the first time,GTIG has identified malware families,such as PROMPTFLUX and PROMPTSTEAL,that use Large Language Models(LLMs)during execution.These tools dynamically generate mali