DUSTMAKER

Credential-stealing malware family tracked by Google, notable for hiding its artifacts in hidden project directories used by AI developer tooling.

Current stories

buildOne report1 publisher

A static denylist stopped one more prompt injection than no protection in a coding-agent study

Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.

Publishers:dev.to

Reality

Evidence45
Adoption: Not scored
Hype gap+10
Incentives: Not scored
Confidence50

securityOne report1 publisher

Google clocks TeamPCP standing up a mass credential-harvesting campaign in under six hours

GTIG's 2026 accounting traces one crew from package-registry compromises on PyPI, npm and Docker Hub to agent instructions that planned and ran the campaign, then out to public malware releases anyone can reuse.

Publishers:securityweek.com

Reality

Evidence48
Adoption45
Hype gap+22
Incentives72
Confidence45

securityOne report1 publisher

Dustmaker lifts GitHub Actions tokens so its packages clear AI coding trust checks

Google Threat Intelligence Group's September 8 report puts a financially motivated actor, UNC6780, inside PyPI, npm and Docker Hub, publishing under stolen maintainer automation and reselling the AI tool credentials it collects afterwards.

Publishers:infosecurity-magazine.com

Reality

Evidence54
Adoption45
Hype gap+22
Incentives64
Confidence56

securityConfirmed3 publishers

Attacker agents ran a mass credential harvest from inside the victim's own cloud in six hours

Mandiant traced the Q2 2026 campaign to an AI coding chatbot, one prompt and a set of agent instructions that ran the scanning pipeline, fixed its own errors and rotated IPs with nobody at the keyboard.

Publishers:bleepingcomputer.com helpnetsecurity.com thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 30%
Operator: Operator 57%
Investor: Investor 13%

Reality

Evidence58
Adoption62
Hype gap+24
Incentives70
Confidence66

productOne report1 publisher

Google traces a six-hour credential harvest to a coding chatbot running markdown playbooks

A human broke in and assembled the framework, and after that the scanning, the retries and the address rotation ran on their own out of the victim's own IPs. That middle stretch is what response clocks have to survive.

Publishers:siliconangle.com

Reality

Evidence55
Adoption60
Hype gap+18
Incentives70
Confidence55