INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

GTIG AI Threat Tracker Identifies Adversaries Exploiting Vulnerabilities via AI

| 2026-05-11 14:00 MEDIUM LOW EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
In May 2026, actors from Russia, Iran, China, and Saudi Arabia produced political satire materials to advance specific narratives across digital platforms and physical media. The malicious activity was linked to the pro-Russia IO campaign "Operation Overload," involving video content that leveraged suspected AI voice cloning to impersonate real journalists. This campaign utilized a novel multi-layered defense mechanism called PROMPTSPY, which can capture victim biometric data to replay authentication gestures and regain access to compromised devices. If uninstallation attempts are made, the malware renders an invisible overlay over the "Uninstall" button, making it appear unresponsive to users. Google has taken action against this actor by disabling associated assets, and Android users are automatically protected against known versions of PROMPTSPY through Google Play Protect.
Technical Mitigations AI-generated
• Block or hunt for Firebase Cloud Messaging (FCM) traffic to prevent relaunching of the PROMPTSPY backdoor. • Use a detection technique such as AppProtectionDetector module analysis to identify and flag suspicious activity on Android devices. • Patch against known versions of PROMPTSPY by keeping Google Play Protect enabled on Android devices with Google Play Services.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation OverloadOperation Overload
Target & Sectors
RU IR IO SA CN
Incident Timeline
‎2026/05/11
Threat actors from Russia, Iran, China, and Saudi Arabia are using large language models (LLMs) to generate political satire and materials for advanced narratives across digital platforms and physical media.
infrastructure Android
These AI-enabled capabilities are a notable evolution from conventional Android backdoors that heavily rely on human interaction.
Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.
Tactical Metrics
Metrics
infrastructure
‎Android
Affected Product
These AI-enabled capabilities are a notable evolution from conventional Android backdoors that heavily rely on human interaction.
Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services.
Intelligence Sources
Mandiant 2026-05-11
Mandiant 2026-05-11