Ledger / 29 Jan 2025
APT42 used Gemini for phishing content and defense-expert recon
Confirmed
Google observed the group's Gemini activity directly.
Iranian APT42 used Gemini to research individual policy and defense experts, craft tailored phishing material, and research public vulnerabilities in products like Mikrotik, Apereo and Atlassian.
“APT42's Gemini activity reflected the group's focus on crafting successful phishing campaigns.”Google Threat Intelligence Group
Sources
- Adversarial Misuse of Generative AIGoogle Threat Intelligence Group · 29 Jan 2025 · primary source
- Disclosed
- 29 Jan 2025
- Activity
- 2024
- Actor
- APT42 (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- Iran
- Targets
- Defense experts and a US defense organization
- What the AI did
- Recon, Phishing content, Vuln research
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Google reports misuse; no breach attributed to the Gemini use in the report.