Image: SiliconAngle / siliconangle.com Attackers Used AI Agents to Steal Credentials in Six Hours. Your .claude Directory Is a Target.
Google's Threat Intelligence Group reports that threat actors are using autonomous AI frameworks to run credential-theft campaigns in hours — and AI coding tool directories are prime targets.
A financially motivated threat group used an autonomous AI framework to compromise thousands of credentials in under six hours, according to a Google Threat Intelligence Group report published September 8. The attackers assembled the framework from an AI coding chatbot, a prompt, and a set of agent instructions — and IP rotation and troubleshooting occurred without human operator involvement.
John Hultquist, Google TIG’s chief analyst, put it plainly: “Criminals, like the ones who conducted a mass exploitation campaign in just six hours, will gravitate to attacks that are faster than we can respond to.”
The threat group: UNC6780
Google tracks the group as UNC6780, also called TeamPCP by the Cloud Security Alliance. It’s financially motivated and has been running open-source supply chain compromises since early 2026, targeting PyPI, npm, and Docker Hub.
The group’s signature is indirect access: rather than attacking target organizations directly, UNC6780 poisons widely trusted developer tooling that those organizations already run in their build environments. By the time credentials are harvested, they’re coming from CI/CD pipelines that already have elevated permissions.
DUSTMAKER and the .claude directory
UNC6780’s credential stealer, tracked as DUSTMAKER, has a detail that’s directly relevant to developers using AI coding tools.
DUSTMAKER drops malicious files into hidden project directories including .claude and .cursor — the directories where Claude Code and Cursor store configuration files, session tokens, and API keys. The malware blends into developer clutter that build systems and AI tools read as ordinary files, then harvests the credentials stored there.
The attack path: a developer installs a compromised package from npm or PyPI, the package drops DUSTMAKER files into the project directory, DUSTMAKER reads credentials from .claude and .cursor, and those credentials are sold to other criminal groups.
How the six-hour credential theft worked
The September 8 report describes a separate but related attack pattern where a threat actor gained access to cloud infrastructure and then “assembled an autonomous framework out of an AI coding chatbot, a prompt and a set of agent instructions.” The framework scanned for credentials, harvested them, and rotated IPs without human involvement — completing the operation in under six hours.
That’s the new part. Credential theft campaigns have always existed, but they’ve historically required sustained human operator time. Automating the scanning and harvesting step with an AI agent compresses the timeline dramatically, and the attack surface grows with every new developer using AI tooling.
What’s at risk
The elevated risk comes from two trends colliding. More developers are using AI coding tools that store API keys and session tokens in project directories. And those same projects are pulling in more open-source packages, which are the delivery vehicle for malware like DUSTMAKER.
Google notes that broader threat activity has also shifted: state-sponsored groups that previously targeted only AI labs and frontier model companies are now going after any organization using AI in government, military, or healthcare contexts.
What to do
The practical steps are consistent across the industry:
- Audit what’s in your
.claudeand.cursordirectories. Don’t store long-lived API keys there if you can avoid it. - Pin package versions in your CI/CD pipelines rather than using floating ranges.
- Review recent package installs for any unexpected post-install scripts.
- Use secret scanning on your repositories to catch exposed credentials before they’re harvested.
Claude Code specifically stores its session tokens in ~/.claude/ rather than project-level .claude/ directories by default — the project-level directory is used for settings files and CLAUDE.md, not credentials. But the malware targets the directory regardless of what it finds there, so keeping sensitive data out of it is still good practice.
Sources: Google Cloud Blog, SiliconAngle, Infosecurity Magazine, Cloud Security Alliance on UNC6780