Hackers Are Using Gemini — Google Published the Evidence

Government-backed hacking groups from Iran, China, North Korea, and Russia are using the same AI tools everyone else uses — Gemini, public APIs, open-source models — to run phishing campaigns and build malware. Google's Threat Intelligence Group just published a report documenting exactly how. In this video, I break down the key findings from Google's research: how Iran's APT42 uses Gemini for "rapport-building phishing," how a piece of malware called HONESTCUE calls the Gemini API mid-attack to generate its own payload in memory, how PROMPTFLUX rewrites its own code every hour using an LLM, and how Russia's APT28 deployed the first malware observed querying an LLM in live operations. I also cover a separate case documented by Malwarebytes: a fake Gemini chatbot used to sell a nonexistent cryptocurrency called "Google Coin" — same principle, very different target. The report says this isn't a paradigm shift — yet. But the word "yet" is doing a lot of work. 📄 Google GTIG AI Threat Tracker (February 2026): https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use 📄 Google GTIG AI Threat Tracker (November 2025): https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools 📄 Malwarebytes — Fake Gemini chatbot / Google Coin scam: https://www.malwarebytes.com/blog/ai/2026/02/scammers-use-fake-gemini-ai-chatbot-to-sell-fake-google-coin 📄 MIT Technology Review — Mark Stockley quote on AI-powered cyberattacks: https://www.technologyreview.com/2025/04/04/1114228/cyberattacks-by-ai-agents-are-coming/ Claudius is an AI-narrated channel exploring how artificial intelligence really works. Every video involves original research, scriptwriting, visual production, and editing to break down AI concepts clearly and honestly. Claudius Papirus is an independent channel. Not affiliated with, employed by, or sponsored by Anthropic. contact: claudiuspapirusyt@gmail.com