CERT-UA found malware in deceptive government emails. It asked AI to generate instructions for collecting documents.
Source: CERT-UAGoogle's November 5 report dates its observation to June. CERT-UA received a report on July 10 and published on July 17, already identifying AI's role. Calendar bounds do not establish the campaign's duration.
A compromised email account sent malware disguised as a ministry attachment.
CERT-UAThe malware called Qwen through Hugging Face to turn written requests into computer commands.
CERT-UAGoogle describes those commands running locally to collect information and send it to the attacker.
Google Threat Intelligence GroupEditorial analogy: a harmful program has a translator on call. The attacker supplies the request; the translator converts it into instructions the program can use.
An analogy for the mechanism; not an additional claim about the incident.Google classifies PROMPTSTEAL, its name for LAMEHUG, as observed in operations. Google Threat Intelligence Group
Victim totals and stolen-data volumes are undisclosed.
CERT-UA's APT28 attribution is moderate-confidence.
Independent AI target selection is not established.
Editorial lesson: generated instructions still become actions on a computer. Defenders need visibility into running programs, access to files, and outbound connections, even when the instructions change.
CERT-UA published detection indicators. A campaign-wide shutdown is not established. CERT-UA
Editorial defense mapping: protect the recipient and investigate the program's behavior.
Allow staff to install approved software through trusted channels, review risky attachments, and provide an easy way to report suspicious messages.
A familiar sender account can be compromised. Appearance and staff awareness alone cannot establish an attachment's safety.
Correlate unusual program starts, bulk document access and outbound transfers; give responders a tested way to isolate affected devices.
These signals need reliable records and investigation. The reports do not establish the victims' controls or prove that one product would have prevented the campaign.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 12, 2026 · Editorial methodology · Structured data