The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence (AI)-powered coding tools to strike targets with various implants.
The activity is designed to produce a “high-volume, mediocre mass of implants” that are developed using lesser-known programming languages like Nim, Zig, and Crystal and rely on trusted services like Slack, Discord, Supabase, and Google Sheets to fly under the radar, according to new findings from Bitdefender.
“Rather than a breakthrough in technical sophistication, we are seeing a transition toward AI-assisted malware industrialization that allows the actor to flood target environments with disposable, polyglot binaries,” security researchers Radu Tudorica, Adrian Schipor, Victor Vrabie, Marius Baciu, and Martin Zugec said in a technical breakdown of the campaign.
The transition towards vibe-coded malware, aka vibeware, as a means to complicate detection has been characterized by the Romanian cybersecurity vendor as Distributed Denial of Detection (DDoD). In this approach, the idea is not to sidestep detection efforts through technical sophistication, but rather to flood target environments with disposable binaries, each using a different language and communication protocol.
Helping threat actors in this aspect are large language models (LLMs), which lower the barrier to cybercrime and collapse the expertise gap by enabling them to generate functional code in unfamiliar languages, either from scratch or by porting the core business logic from more common ones.
The latest set of attacks has been found to target the Indian government and its embassies in multiple foreign countries, with APT36 using LinkedIn to identify high-value targets. The attacks have also singled out the Afghan government and several private businesses, albeit to a lesser extent.
The infection chains likely begin with phishing emails bearing Windows shortcuts (LNKs) bundled within ZIP archives or ISO images. Alternatively, PDF lures featuring a prominent “Download Document” button are used to redirect users to an attacker-controlled website that triggers the download of the same ZIP archives.
Regardless of the method used, the LNK file is used to execute PowerShell scripts in memory, which then download and run the main backdoor and facilitate post-compromise actions. These include the deployment of known adversary simulation tools like Cobalt Strike and Havoc, indicating a hybrid approach to ensure resilience.
Some of the other tools observed as part of the attacks are listed below –
- Warcode, a custom shellcode loader written in Crystal that’s used to reflectively load a Havoc agent directly into memory.
- NimShellcodeLoader, an experimental counterpart to Warcode that’s used to deploy a Cobalt Strike beacon embedded into it.
- CreepDropper, a .NET malware that’s used to deliver and install additional payloads, including SHEETCREEP, a Go-based infostealer that uses Microsoft Graph API for C2, and MAILCREEP, a C#-based backdoor utilizing Google Sheets for C2. Both malware families were detailed by Zscaler ThreatLabz in January 2026.
- SupaServ, a Rust-based backdoor that establishes a primary communication channel via the Supabase platform, with Firebase acting as a fallback. It contains Unicode emojis, suggesting that it was likely developed using AI.
- LuminousStealer, a likely vibe-coded, Rust-based infostealer that uses Firebase and Google Drive to exfiltrate files matching certain extensions (.txt, .docx, .pdf, .png, .jpg, .xlsx, .pptx, .zip, .rar, .doc, and .xls).
- CrystalShell, a backdoor written in Crystal that’s capable of targeting Windows, Linux, and macOS systems, and uses hard-coded Discord channel IDs for C2. It supports the ability to run commands and gather host information. One variant of the malware has been found to use Slack for C2.
- ZigShell, a counterpart to CrystalShell that’s written in Zig and uses Slack as its primary C2 infrastructure. It also supports added functionality to upload and download files.
- CrystalFile, a simple command interpreter written in Crystal that continuously monitors the “C:UsersPublicAccountPicturesinput.txt” and executes the contents using “cmd.exe.”
- LuminousCookies, a Rust-based specialized injector to exfiltrate cookies, passwords, and payment information from Chromium-based browsers by circumventing app-bound encryption.
- BackupSpy, a Rust-based utility designed to monitor the local file system and external media for high-value data.
- ZigLoader, a specialized loader written in Zig that decrypts and executes arbitrary shellcode in memory.
- Gate Sentinel Beacon, a customized version of the open-source GateSentinel C2 framework project.
“The transition of APT36 toward vibeware represents a technical regression,” Bitdefender said. “While AI-assisted development increases sample volume, the resulting tools are often unstable and riddled with logical errors. The actor’s strategy incorrectly targets signature-based detection, which has long been superseded by modern endpoint security.”
Bitdefender haș warned that the threat posed by AI-assisted malware is the industrialization of the attacks, allowing threat actors to scale their activities quickly and with less effort.
“We are seeing a convergence of two trends that have been developing for some time: the adoption of exotic, niche programming languages, and the abuse of trusted services to hide in legitimate network traffic,” the researchers said. “This combination allows even mediocre code to achieve high operational success by simply overwhelming standard defensive telemetry.”
