Google discovers hackers using AI technology to develop new malware to steal cryptocurrency

According to a report by Decrypt, Google's Threat Analysis Group has found at least five new types of malware that are dynamically generating and hiding malicious code using large language models (LLMs). Among them, the North Korea-linked hacker group UNC1069 has been discovered using Gemini to probe wallet data and create phishing scripts with the intent to steal digital assets.

These malware employ "real-time code creation" techniques to evade traditional security detection by calling external AI models such as Gemini or Qwen 2.5-Coder. Google stated that it has disabled the relevant accounts and strengthened security measures for model access.