How State-Backed Hackers Are Using Gemini in Cyberattacks

State-backed and financially motivated attackers are using generative AI to complete familiar cyberattack tasks faster. In a February 2026 report, Google Threat Intelligence Group (GTIG) described misuse of Gemini for target research, tailored phishing, translation, code troubleshooting, vulnerability research, and post-compromise support.

The important finding is not that AI has created an unstoppable new class of attack. Google said it had not observed tracked advanced persistent threat groups gaining breakthrough capabilities that fundamentally changed the threat landscape. The immediate risk is greater speed, scale, and polish across techniques defenders already understand.

What Google observed

GTIG examined activity linked to actors based in or associated with China, Iran, North Korea, and Russia during late 2025. The report links Gemini misuse to several stages of the attack lifecycle:

• Reconnaissance: collecting public information about organizations, employees, technologies, and potential targets.
• Social engineering: drafting more convincing lures, translating messages, and sustaining believable conversations.
• Vulnerability research: organizing known information, analyzing test results, and planning assessments under fabricated security-research scenarios.
• Tool development: explaining code, translating code between languages, debugging errors, and refining malicious tools.
• Post-compromise activity: assisting with tasks after access has already been obtained.

Google says it disabled associated accounts and assets and used the observed behavior to strengthen Gemini's classifiers and model-level safeguards. The full GTIG threat report provides the attribution and case-study details.

AI accelerates established tactics

Large language models can remove friction from work that previously required more time or language skill. An attacker can quickly summarize a target's public footprint, turn rough notes into a polished email, adapt a lure for another country, or troubleshoot a script. This does not guarantee a successful intrusion, but it lets a group test more approaches in less time.

Phishing quality is therefore a weaker signal than it once was. Correct grammar, a professional tone, and knowledge of an employee's role no longer indicate that a message is genuine. Organizations should instead verify the sender, destination, requested action, authentication context, and any unexpected change of payment or access instructions. Technical controls such as SPF, DKIM, and DMARC also matter; TipsMake explains them in its guide to email security protocols.

What model extraction means

The report separately covers model-extraction attempts, sometimes called distillation attacks. An actor with legitimate API access sends large numbers of carefully selected queries and uses the responses to train another model or reproduce a capability. Google described one campaign involving more than 100,000 prompts intended to elicit reasoning behavior in non-English languages.

This is primarily an intellectual-property and service-abuse risk for model providers, not evidence that ordinary Gemini users' private conversations were extracted. Google said its systems detected and mitigated the campaign. Knowledge distillation itself is a legitimate machine-learning technique; the abusive element is attempting to copy a provider's system without authorization.

Why defenders should focus on behavior

Security teams usually cannot determine from an email or script alone whether AI helped create it. Detection plans should concentrate on observable behavior rather than guessing the authoring tool.

• Monitor unusual sign-ins, token creation, privilege changes, and access from unfamiliar devices or locations.
• Alert on rapid reconnaissance, scanning, repeated authentication failures, and abnormal data access.
• Use endpoint and network telemetry to detect execution, persistence, command-and-control traffic, and data exfiltration.
• Require phishing-resistant multifactor authentication for high-value accounts where feasible.
• Restrict administrative privileges and separate routine accounts from privileged ones.
• Keep internet-facing software inventoried and patched, and remove services that are no longer required.
• Test incident-response paths so analysts can contain an account or endpoint quickly when evidence appears.

For individual users, browser and operating-system protections still provide useful layers. TipsMake's overview of Microsoft Edge security features explains how reputation checks and download protection can help, although no browser can make an unsafe action risk-free.

Defending AI services from abuse

Organizations that expose language-model APIs should treat them like other valuable production services. Use scoped credentials, rotate keys, set quotas, separate development from production, and alert on abrupt changes in request volume, geography, prompt structure, or account behavior. Do not embed unrestricted keys in client-side code or public repositories.

Model providers may also look for repetitive extraction patterns and enforce rate limits or additional verification. These controls need careful tuning because high-volume legitimate evaluation and accessibility workflows can resemble automated misuse.

The practical takeaway

AI-assisted attacks are often faster versions of known attacks. That makes disciplined basics more important, not obsolete: strong identity controls, current software, layered logging, tested response procedures, and independent verification of sensitive requests. Defenders should plan for attackers who can research and rewrite quickly while continuing to judge incidents by evidence in their systems.