TeamPCP's DUSTMAKER Framework Harvests Thousands of Credentials in Six Hours via Autonomous AI Agents

The operation began with supply chain compromises followed by SANDCLOCK on Linux Kubernetes targets that included container escapes and crypto wallet theft. DUSTMAKER succeeded it as a JavaScript payload focused on CI/CD environments, adding AI workspace poisoning and prompt injection for evasion that were absent in earlier variants. GTIG linked these to monetization via ransomware partnerships and direct credential sales.

Evidence includes observed targeting of AI coding assistants for API key exfiltration and UNC6508's deployment of local open-weight LLMs in compromised cloud instances to avoid commercial model monitoring. Distillation attacks against Google's visual and audio models were also recorded alongside data theft of proprietary prompts and research. No independent technical attribution beyond GTIG telemetry confirms the actor identities.

This reveals a pattern where agentic AI compresses attack timelines below defender response windows, extending TeamPCP's prior supply chain activity into AI-specific extortion. Official statements emphasize universal AI adoption by threat actors yet lack granular exploit timelines or payload samples that would allow external verification of the six-hour claim.

Defenders must instrument AI assistant workspaces and CI/CD prompt flows for injection attempts while reducing credential lifetime in developer environments. Procurement of AI coding tools without corresponding runtime monitoring will widen exposure as similar frameworks proliferate.