What Recent AI-Powered Attacks Mean for Your Identity Security

Introduction

AI is changing the economics of cybercrime — and identity security is ground zero. On September 8, Google Threat Intelligence Group (GTIG) detailed several attacks that show how quickly AI is reshaping what attackers can do.

In one credential-harvesting campaign, a threat actor first compromised an organization's cloud infrastructure, then built and deployed a multi-agent attack framework. The operation took less than six hours in total and resulted in thousands of third-party credentials being compromised.

One of the main benefits of AI for organizations is the productivity gains it can deliver. Unfortunately, threat actors can use those same capabilities to make attacks faster and easier to scale. Credentials are already routinely harvested through infostealers, and AI simply removes some of the work required to carry attacks out.

As credentials are becoming easier to steal at scale, security teams must ensure their current authentication processes are robust enough to confidently establish that users and devices connecting to internal networks are trustworthy.

What Google Found: A Six-Hour Credential Heist

The GTIG case study is a template for the new AI-powered attack economy:

Phase	What Happened
1. Initial compromise	Threat actor compromised an organization's cloud infrastructure
2. Build	Built a multi-agent attack framework
3. Deploy	Deployed the framework to harvest credentials at scale
4. Automate	AI managed parts of the vulnerability-scanning pipeline
5. Troubleshoot	AI troubleshot problems as they arose
6. Evade	AI rotated IP addresses with minimal human intervention
Total time	Less than 6 hours
Result	Thousands of third-party credentials compromised

AI Is Automating the Credential Theft Playbook

Microsoft reported in April that AI-assisted phishing campaigns it observed were achieving click-through rates as high as 54%, compared with around 12% for traditional campaigns.

If attackers can make the same campaign more convincing without spending proportionally more time creating it, the economics of phishing start to shift in their favor. For credential theft, that's especially important as it's partly a numbers game.

Not every recipient will click, and even those accounts that do become compromised may not provide useful access. With AI, attackers can:

• Generate targeted messages more quickly
• Adapt them for different languages or industries
• Create variations without writing each one from scratch

Improving the success rate at the start of that process gives attackers more credentials to test and more opportunities to find the accounts that matter.

The Credential Problem in Numbers

Two industry reports frame the scale of the problem:

According to Verizon's Data Breach Investigation Report, stolen credentials are involved in 44.7% of breaches.

And according to Unit 42's 2026 Global Incident Response Report, identity weaknesses played a material role in 89% of investigations, with attackers using stolen credentials and tokens to gain access and move through environments.

Successful Authentication Isn't Necessarily Trustworthy

The threat of stolen credentials is straightforward: they let an attacker use the same access routes as a legitimate user.

Abusing valid identities changes what malicious activity looks like to defenders. There may be no exploit attempt or obviously malicious login mechanism to spot.

An attacker can access cloud services, SaaS applications, and other resources through the same authentication processes employees use every day. The credentials are valid; the intent behind them is not.

This is where the distinction between authentication and trust starts to matter.

Authentication	Trust
A correct password, MFA response, or valid session	Whether the device is known and approved
Establishes that an authentication requirement has been met	Establishes that the request comes from a device the organization knows and trusts
Can be satisfied with stolen credentials	Cannot be satisfied from an unknown device

When building an identity security strategy that is truly resilient against AI-enabled attacks, the question therefore cannot stop at "Did this user authenticate successfully?" It also needs to include "What device is requesting access, and should we trust it?"

Make Stolen Credentials Less Useful

Password hygiene can reduce exposure, but no organization can assume credentials will never be compromised. The prevalence of credential harvesting malware creates situations where an attacker may end up with valid authentication material despite preventative controls.

The next question is: what can that credential do?

If authentication is restricted to devices that have already been approved and bound to a user's identity, a valid password alone is no longer enough. An attacker trying to reuse it from an unknown device has another trust check to overcome.

In practice, that means a stolen credential used from an attacker-controlled machine will simply be blocked.

Why Zero Trust Device Verification Matters

Zero Trust measures like device trust especially matter across a mixed workforce. BYOD policies spanning different operating systems and endpoint types are common, and it can be a challenge to implement security measures that cover them all.

Modern device trust solutions apply across Windows, macOS, Linux, and mobile, meaning security teams have visibility over every device connecting to the network.

How to Uncover Compromised Credentials in Your Directory

AI may make credential theft faster and easier to scale, but attackers still benefit from familiar weaknesses such as weak and reused passwords. That makes visibility a useful first step.

Before security teams can reduce credential exposure, they need to know where the weaknesses are in their own environment.

A password auditor tool can perform a read-only scan of your Active Directory to identify password-related vulnerabilities and highlight issues with users and password policies. The resulting report gives security teams a clearer view of where credential risk exists today, so they can prioritize what needs attention.

What Businesses Should Do

If your organization wants to stay resilient against AI-powered credential attacks, here's a practical checklist:

• Assume credentials will be stolen — Design your security so a stolen password isn't enough
• Audit your Active Directory — Run a read-only scan to find weak, reused, and compromised passwords
• Enforce strong password policies — Block known-compromised passwords at the point of change
• Deploy MFA everywhere — Especially on email, VPN, and cloud admin accounts
• Add device trust — Bind identities to approved devices so stolen credentials can't be reused elsewhere
• Cover all platforms — Windows, macOS, Linux, and mobile, especially under BYOD
• Monitor for impossible travel — Flag logins from unusual locations or devices
• Watch token theft — Session tokens are as valuable as passwords
• Train users against AI phishing — 54% click-through means traditional awareness isn't enough
• Adopt Zero Trust principles — Authenticate the identity, verify the device, require both
• Prepare for speed — Six-hour attack windows demand faster detection and response

Final Thoughts

AI is not inventing new attack techniques — it's making existing ones faster, cheaper, and more effective. The Google GTIG case shows what that looks like in practice: a six-hour, largely automated credential heist that compromised thousands of accounts.

The defensive implication is clear. Password hygiene still matters, but it's no longer sufficient on its own. Organizations need to move from "did this user authenticate?" to "is this device trusted?" — and require both.

Key takeaways:

• Six-hour attacks — Google GTIG documented a multi-agent credential heist in under six hours
• 54% vs 12% — AI-assisted phishing click-through rates are 4.5× traditional campaigns
• 44.7% of breaches — Involve stolen credentials (Verizon DBIR)
• 89% of investigations — Involve identity weaknesses (Unit 42)
• Authentication ≠ trust — A valid password doesn't prove the request is legitimate
• Device trust closes the gap — Bind identities to approved devices; block stolen credentials from unknown machines
• Cover every platform — Windows, macOS, Linux, and mobile, especially in BYOD environments
• Visibility first — Audit your directory to find credential risk before attackers do
• Zero Trust is the framework — Authenticate the identity, verify the device, require both
• Speed matters — Detection and response must keep up with AI-assisted attacks

If your organization needs help strengthening identity security against AI-powered credential attacks, auditing Active Directory, or implementing device trust, contact SystemLogicIT for expert guidance across the United States and United Kingdom.