Google Gemini CLI abused as a hacking agent, malware botnet operator
2026-07-15T19:23:32Z•0105669b1dc38a110062465877130a8ee6e2b154bef4feaf7df8686b1bbac41a
ai-abuseai-red-teamasyncapibotnetbulletproof-hostingcisacredential-stealergemini-cligithub-malwarelaw-enforcementmicrosoft-patch-tuesdaynpm-supply-chainpatchingphishingsharefilesharepointsma1000sonicwallvulnerability-discoverywindows-updateszero-day
What happened
Multiple high-impact security stories from BleepingComputer: a Russian-speaking actor abused Google's open-source Gemini CLI as a hacking agent and to run a small botnet; five AsyncAPI npm package releases were backdoored to deliver a credential‑stealing RAT in a supply‑chain attack; researchers built an AI-driven “vulnerability vending machine” that found zero-days; CISA warns of active exploitation of three on‑premises SharePoint flaws; SonicWall reports two SMA1000 vulnerabilities (CVE-2026-15409, CVE-2026-15410) being exploited in zero‑day attacks and urges patching; Progress confirmed a高‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 0105669b1dc38a110062465877130a8ee6e2b154bef4feaf7df8686b1bbac41a
- Enrichment time
- 2026-07-15T19:23:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.