{"id":240957,"date":"2026-07-16T00:28:22","date_gmt":"2026-07-16T05:28:22","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/07\/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator"},"modified":"2026-07-16T00:28:22","modified_gmt":"2026-07-16T05:28:22","slug":"google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/07\/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator","title":{"rendered":"Google Gemini CLI abused as a hacking agent, malware botnet operator"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/google-gemini-cli-abused-as-a-hacking-agent-malware-botnet-operator.jpg\"><\/a><\/p>\n<p>A Russian-speaking threat actor known as \u201cbandcampro\u201d used Google\u2019s open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet.<\/p>\n<p>The AI agent responded to the attacker\u2019s prompts, troubleshooting problems on the fly and even proposing operational improvements at least 59 times.<\/p>\n<p>In more than 200 sessions between May 19 and April 21, the threat actor worked with the AI tool to deploy and operate an infrastructure that controlled eight systems in a dental clinic and to get access to the OpenDental database.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Russian-speaking threat actor known as \u201cbandcampro\u201d used Google\u2019s open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. The AI agent responded to the attacker\u2019s prompts, troubleshooting problems on the fly and even proposing operational improvements at least 59 times. In more than 200 sessions between May 19 and [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,34,6],"tags":[],"class_list":["post-240957","post","type-post","status-publish","format-standard","hentry","category-biotech-medical","category-cybercrime-malcode","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/240957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=240957"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/240957\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=240957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=240957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=240957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}