Ledger / Nov 2025
COINBAIT crypto-exchange phishing kit built with AI code generation
Strong
Google infers AI use from source code artifacts and gives high-confidence infrastructure overlap, not provider telemetry.
The phishing kit mimicked a major exchange for credential harvesting and was likely accelerated by AI coding tools.
“a phishing kit, whose construction was likely accelerated by AI code generation tools”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial UseGoogle Threat Intelligence Group · 12 Feb 2026 · primary source
- Date
- Nov 2025
- Disclosed
- 12 Feb 2026
- Actor
- UNC5356 overlap (criminal), as attributed by Google Threat Intelligence Group
- Targets
- Cryptocurrency exchange users
- What the AI did
- Phishing content, Malware dev
- Model
- unspecified LLM (AI code generation tools)
- Model family
- Unspecified
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Kit identified Nov 2025.