Reputation Radar #2: The Week AI Built the Botnet

Upfront disclosure: This is written by the small team building Reput.io, not a marketing department. We don't have paying customers yet. Reputation Radar is our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.

Last week the theme was borrowed reputation in general. This week it got a sharper edge: AI is lowering the bar to build attack infrastructure, and the infrastructure it builds hides behind names you already trust. Trusted AI endpoints, GitHub, npm, a legit ISP. The pipe looks normal because it mostly is.

Here's the week through that lens, then the rest of the landscape.

AI is now the one standing up the infrastructure

The headline case is a good one to sit with. Trend Micro analyzed over 200 Gemini CLI session logs from a Russian-speaking actor they call "Patriot Bait" and watched an AI agent complete a full command-and-control migration in about six minutes, with the human doing roughly 11% of the work (Trend Micro; The Register has a readable writeup).

The reputation detail worth pulling out: the actor's old C&C setup ran victim connections through Cloudflare tunnels, and moved only once firewalls and AV started catching it. That's the pattern in one sentence, the malicious channel was riding trusted infrastructure until something forced a change.

Two more in the same vein:

• Chinese operators used Claude Code and DeepSeek to support a government intrusion, per hunt.io's analysis (hunt.io). The tooling is mainstream AI; the traffic to it looks like anyone's.
• "Ghostcommit" hides prompt injection inside images to steer AI coding agents into unwanted actions (BleepingComputer). Different mechanism, same theme: the abuse rides a trusted agent workflow.

For a defender, none of this shows up as a sketchy destination. A call to a mainstream AI provider is genuinely legitimate, so its reputation tells you nothing about what the agent on the other end was told to do.

Trusted repos, at scale

The supply-chain drumbeat continued, and the common thread is that the platform's good name is the cover:

• 148 npm packages disguised as "student proxy" unblockers quietly turned browsers into a DDoS botnet (The Hacker News).
• Nearly 300 GitHub repositories posed as legitimate software to push malware (BleepingComputer).
• An AsyncAPI supply-chain compromise via GitHub Actions let attackers reach npm packages and dev secrets (Wiz).

Here's how that reads in a reputation check. GitHub's own raw-content host comes back whitelisted but verdict: investigate, not benign, and npm's registry does the same:

{ "indicator": "raw.githubusercontent.com",
  "status": "whitelisted",
  "verdict": "investigate" }

The platform is real; the specific repo or package pulled from it is not pre-vetted. "Comes from GitHub" is context, and the verdict says keep looking.

Also on the radar

• First US sanction of a VPN provider for enabling ransomware. The US sanctioned a no-log VPN service and a malware cryptor seller for underpinning ransomware operations (BleepingComputer). Anonymity infrastructure with a clean-looking front, which is exactly why we keep VPN/anonymity ranges at investigate rather than benign.
• Microsoft Patch Tuesday: a record 622 CVEs, including two zero-days (The Hacker News). Prioritize the exploited ones.
• SonicWall SMA1000 flaws exploited in zero-day attacks (BleepingComputer).
• Secure Boot has been quietly broken for a decade (Ars Technica) — worth a read for the long view.

The through-line for a SOC

The AI part is genuinely new, but for triage the problem is the old one, just faster: the attacker's traffic is wearing a trusted name. A call to an AI provider, a package from npm, a binary from a GitHub repo, a tunnel through Cloudflare, all read clean at the network layer. The question that still works isn't "is the destination reputable" but "does this specific action, from this specific account, make sense right now."

That's why we keep cloud, CDN, registries, and AI infrastructure at investigate rather than benign, however impeccable the brand. If you want the longer argument, we made it in why clearing the known-good first is the right triage order.

See you next week.

Sources are linked inline; credit to the original researchers and reporters. If we got a detail wrong, tell us, we'll fix it.