Known as Pakistan backed threat actor transparent tribe has become the latest hacking group to adopt artificial intelligence (AI)-powered coding tools to attack targets with various implants.
The activity is designed to produce “high-volume, measurable implants” that are developed using lesser-known programming languages like Nim, Zig, and Crystal and rely on trusted services like Slack, Discord, SupaBase, and Google Sheets to fly under the radar, according to new findings from Bitdefender.
“Instead of a breakthrough in technological sophistication, we are seeing a shift toward AI-assisted malware industrialization that allows actors to flood target environments with disposable, polyglot binaries,” security researchers Radu Tudorica, Adrian Schipor, Victor Vrabi, Marius Baciu and Martin Zugec said in a technical description of the campaign.
The transition to vibe-coded malware, aka vibewareDistributed Denial of Detection (DDOD) is described by a Romanian cybersecurity vendor as a means of obfuscating identity. In this approach, the idea is not to circumvent detection efforts through technological sophistication, but to flood the target environment with disposable binaries, each using a different language and communication protocol.
Helping threat actors in this aspect are large language models (LLM), which reduce the odds of cyber crime and enable them to generate functional code in unfamiliar languages, either from scratch or by porting core business logic from more common ones.
The latest set of attacks has been found to target the Indian government and its embassies in several foreign countries, with APT36 using LinkedIn to identify high-value targets. The attacks have also targeted the Afghan government and several private businesses, albeit to a lesser extent.
Infection chains likely begin with phishing emails containing Windows shortcuts (LNKs) bundled within ZIP archives or ISO images. Alternatively, PDF lures containing a prominent “Download Document” button are used to redirect users to an attacker-controlled website that triggers the download of similar ZIP archives.
Regardless of the method used, the LNK file is used to execute a Powershell script in memory, which then downloads and runs the main backdoor and facilitates post-compromise actions. These include the deployment of known adversary simulation tools such as Cobalt Strike and Havoc, indicating a hybrid approach to ensure resilience.
Some of the other devices seen as part of the attacks are listed below –
- warcodeA custom shellcode loader written in Crystal that is used to mirror the Havoc agent directly into memory.
- nimshellcodeloaderAn experimental counterpart of the Warcode that is used to deploy the Cobalt Strike Beacon embedded in it.
- creepdropperA .NET malware that is used to distribute and install additional payloads, including SHEETCREEP, a Go-based infostealer that uses the Microsoft Graph API for C2, and MAILCREEP, a C#-based backdoor that uses Google Sheets for C2. Both malware families were detailed by Zscaler ThreatLabz in January 2026.
- SupaServeA Rust-based backdoor that establishes a primary communication channel through the Supabase platform, with Firebase acting as a fallback. It includes Unicode emoji, which suggests it was likely developed using AI.
- glitter stealerA potentially Vibe-coded, Rust-based infostealer that uses Firebase and Google Drive to pull out files matching certain extensions (.txt, .docx, .pdf, .png, .jpg, .xlsx, .pptx, .zip, .rar, .doc, and .xls).
- crystalshellA backdoor written in Crystal that is capable of targeting Windows, Linux, and macOS systems, and uses a hard-coded Discord channel ID for C2. It supports the ability to run commands and gather host information. A variant of the malware has been found to use Slack for C2.
- ZigshellA clone of CrystalShell that is written in Zig and uses Slack as its primary C2 infrastructure. It also supports additional functionality for uploading and downloading files.
- crystalfileA simple command interpreter written in Crystal that continuously monitors “C:\Users\Public\AccountPictures\input.txt” and executes the contents using “cmd.exe”.
- luminouscookiesA Rust-based special injector to exfiltrate cookies, passwords, and payment information from Chromium-based browsers by bypassing app-bound encryption.
- BackupSpyA Rust-based utility designed to monitor local file systems and external media for high-value data.
- zigloaderA special loader written in Zig that decrypts and executes arbitrary shellcode in memory.
- gate sentinel beaconAn adapted version of the open-source GetSentinel C2 Framework project.
Bitdefender said, “APT36’s transition toward malware represents a technological regression.” “While AI-assisted development increases sample volume, the resulting tools are often unstable and full of logical errors. The actor’s tactics unfairly target signature-based detection, which has long been replaced by modern endpoint security.”
Bitdefender warns that the threat posed by AI-assisted malware is the industrialization of attacks, allowing threat actors to scale up their activities faster and with less effort.
“We are seeing a convergence of two trends that have been developing for some time: the adoption of foreign, specialized programming languages and the abuse of trusted services to hide in legitimate network traffic,” the researchers said. “This combination allows even mediocre code to achieve high operational success by overriding standard defensive telemetry.”
