New Threat GreyVibe on AI Supported Cyber Attack Wave

WithSecure researchers reported a new group of threats called GreyVibe, who has been targeting Ukraine since August 2025 in May 2026. The distinguishing aspect of the group uses commercial artificial intelligence tools such as ChatGPT, Google Gemini and Ideogram AI in almost any stage of the attack. In this article, how AI-supported cyber attack methods work, GreyVibe’s five parallel attack chains and concrete measures to get institutions.

In this article: The technical details of the five separate attack chain, how GreyVibe group uses artificial intelligence to develop malicious software from the text, are reviewed connection with the autonom AI attack, which explains Anthropic on November 2025, and methods of protection of individuals and companies.

What is the GreyVibe Attack and Who Is Targeted?

GreyVibe is defined as a threat set, which is previously not documented, based on Russian-speaking operators. WithSecure’s report on May 28, 2026, the group targets military, public, civil and private sector organizations since August 2025. The command infrastructure of the attackers is set to the Moscow time zone. The language, code comments and time zone configuration in the vehicles used indicate that Russia is welded.

Target selection is remarkable. In the room of attack groups such as Ukrainian army, public institutions, critical infrastructure and Ukrainian diaspora. PrincessClub is indicated that the traps associated with are taken even Ukrainian soldiers in the active task. A strong alignment is seen among Russian intelligence interests with the intention of operators. WithSecure adds that the group does not have enough evidence to connect directly to the Russian state.

GrayVibe's maturity level is discussed. The group of researchers defines the middle level sophisticatedly with low. Operational security errors, group tools and methods have been explained to researchers. With LegionRelay, a design error in DroneLink infrastructure provided direct feedback to defenders. Even the intensive use of artificial intelligence, this beginner did not cover errors.

Which Stages of Artificial Intelligence Attack

The most critical aspect of GreyVibe is to make productive artificial intelligence into a structural part of the operation. PhantomMail shows that the metadata and development artifacts of PhantomClick, PrincessClub, DroneLink and Nebo campaigns are used in a wide range of tasks of AI tools. This use is not common, systematically.

Artificial intelligence has been activated in the following stages: writing of the content, producing fake website texts, visual creation, writing and reorganization of malicious software, preparation of background infrastructure scripts. For visual production Ideogram AI used ChatGPT and Google Gemini for code development. In gizers such as DAYLIGHT and TEASOUP (obfuscator) artificial intelligence production code images were detected.

WithSecure report states that the group’s use of artificial intelligence is structural. The meaning of this situation for a defender is clear: aggressive traps and malware can regenerate in hours instead of weeks. A group that can change faster than components can be clustered by researchers, is becoming a much more difficult goal to follow over time. This also summarizes the main danger of the AI-supported cyber attack model.

"It is remarkable about GreyVibe, not the attack chains are completely new. Help AI to industrialize these chains of threat actors. (Shane Barney, Keeper Security CISO, SC Media)

How GreyVibe Works Five Attack Chain?

WithSecure documented five separate attack chains, each of the group carries a unique trap and load (payload). While these chains appear different, these chains combine in common malicious software infrastructure. According to the details that Bleeping Computer transferred All of the chains are aimed at placing tools like PhantomRelay, LegionRelay and FallSpy into target systems.

PhantomMail: Targeted fishing (spear-phishing) emails are used. Emails redirect to malicious ZIP or RAR archives hosted on Google Drive and 4sync. Archives Includes JavaScript-based installers and run the PowerShell-based remote access truva at the background while opening a fake PDF. Traps in Ukraine mimic public, emergency, telecom and energy institutions.

PhantomClick: Zoom and LAPAS are used fake CAPTCHA pages that mimic their site. ClickFix style in this method, the user runs the command of a fake Cloudflare verification zannet with his own hands and starts the same PhantomRelay infection chain.

Princess Club: Fake Ukrainian adult club and flirting sites are activated. FallSpy spy software to Android devices is infected with PhantomRelay or LegionRelay to Windows systems. Operators used fake female Telegram contacts and then added WebRTC-based live interview feature that can capture the image of the victim with voice. These methods combined with synthetic sound and image production of artificial intelligence, previously discussed artificial intelligence and voice cloning brings risks to the agenda.

DroneLink: FPV drone and UAV-themed fake Ukrainian military aid associations are fictioned. In March and April 2026, these sites shared the same C2 infrastructure with PrincessClub, ZAPiXDESK tools with WireGuard and LegionRelay scripts hidden with DAYLIGHT. WithSecure Labs analysis frontforce[. File names such as fake association domains are examples.

Nebo: A smaller set of artifacts that mimic a Russian military communication system called ". ." (SPO NEBO). A FallSpy example that mimics Russian military input screen and

A fake login page hosted on PrincessClub infrastructure was detected.

The common point of these chains is to convince the victim to act with his own hands at one point. A fake CAPTCHA, a fake donation campaign or a fake dating profile, all designed to build trust. The flux texts and realistic visuals produced by artificial intelligence make this trust-building step much more intensifier than the former.

What Does PhantomRelay, LegionRelay and FallSpy Do?

While attack chains use different traps, three main malicious software stands out on the load side. These tools offer a wide data collection and remote control ability once enters the system.

PhantomRelay, a remote access truva horse based on PowerShell (RAT). The system carries fingerprint removal, remote script loading, PowerShell and Windows command running capabilities. LegionRelay is more comprehensive: file thieves, screenshot capture, browser identification steal, Telegram and WhatsApp data leaking and RDP access is able to install.

FallSpy is a spy software for Android devices completely. PrincessClub and Nebo campaigns were distributed. The data collected include contact lists, call logs, GPS location, SIM information, media files and device identifiers. The intelligence value was designed to collect high information when it comes to mobile targets.

What Are the Differences Between GreyVibe and GTG-1002?

GreyVibe is not a case alone, but part of a wider trend. Anthropic on November 2025 announced the first cyber spy campaign organized by artificial intelligence. The attacker Claude Code tool in this operation attributed to a high confidence Chinese state-supported group (namedGTG-1002).

The scale difference between GreyVibe with this incident is important. Artificial intelligence in the GTG-1002 campaign was conducted by itself with about 80 percent of the attack and human intervention was required only at several critical decisions. In the peak of the attack, artificial intelligence worked at a speed that produces more than one request per second, a human team will never access. According to the report of Anthropic, AI sometimes made error by stating credentials, which remains one of the obstacles in front of full autonomous attacks.

The difference between two cases is in the depth of the role of artificial intelligence in the attack. When using GreyVibe artificial intelligence as a productivity tool, GTG-1002 has largely turned into artificial intelligence. The table below compares two approaches.

30 global targets

Detecting

Home

Anthropic

Anthropic banned from March 2025 to March 2026 Based on 832 malicious account mapping analysis threaten actors are increasingly using artificial intelligence in late and complex stages. These two cases indicate a period where AI reduces the cost of the attack and the groups with less resources are able to perform large-scale operations.

The cost side is the most critical size of this table. Earlier, a fishing campaign, fake site network and special malicious software was required for weeks of expertise. Commercial artificial intelligence tools download this job to a few per month subscription levels. GreyVibe used widely tools like ChatGPT and Gemini directly instead of group, open source or jailbreaked special models. This drop of access barrier means increased the number of threat vectors. Similar risks, previously discussed harmful artificial intelligence models and measures Home It is also reviewed.

How to Protect Institutions and Individuals?

The assumption that the traps and malware of the saldurga can be reproduced in hours is to create the basis of the defense strategy. One-time indicators (indicator) are more effective to focus on closing behavioral gaps instead of skating. GreyVibe case shows that defense should be accelerated.

Several measures appear in the individual level. The first rule to open ZIP or RAR archives from the links you did not recognize. It is also critical to copying and running the commands that fake page pages want. Enable multi-factor authentication in each account and complete the list of trusting people who do not know on Telegram or flirt platforms. ClickFix style attacks the command of the victim in his own hands, the most critical point of trap.

The implementation of the least privilege principle at corporate level is recommended to be recorded in the employee activities, limiting sensitive data with very factor verification and establishing early warning mechanisms. Regular awareness training for employees also complements the table. Methods such as GreyVibe's fake CAPTCHA and fake donation campaigns target very human behavior from technical defense. It should not be noted that artificial intelligence is a tool on both attack and defense side. For those who want to deepen about this AI security and hackability addressed as a separate header.

What does the community think?

Donations

A part of security researchers see GreyVibe as a warning sign. WithSecure team, speaking to SecurityWeek, states that the group offers a prediction on how to work in the future criminal organizations and government-connected groups. It is noted that the attackers use artificial intelligence to increase speed, scale and sophistication and the use of AI as they develop will also develop. It shows that mobile spy software like FallSpy is targeting soldiers in the active task, the risk is technical and touches life safety.

Featured Upcomings

WithSecure report offers a point that balances the table. GreyVibe’s attack chains are not completely new, but only the existing methods of artificial intelligence are noted. Operational security errors of the group prove that artificial intelligence covers the beginner. In the report of Anthropic, it shows that artificial intelligence impairs identity information, full autonomous attacks are not yet ripening. According to this opinion, defenders can also provide advantages using the same AI tools.

Frequently Asked Questions

Who is GreyVibe, and how does it take?

GreyVibe is a threat group, reported by WithSecure on May 2026, based on Russian-speaking operators. Since August 2025, the Ukrainian army targets public institutions, civil structures and private companies. Command infrastructure is set to Moscow time zone and its targets cover with Russian intelligence interests.

GreyVibe what used AI tools?

Group ChatGPT and Google Gemini for code development and re-editing, Ideogram AI used for visual production. Artificial intelligence has also been launched in writing texts, producing fake website contents and preparing backend infrastructure scripts.

How different is AI-supported cyber attack from traditional attacks?

Basic difference in speed and scale. Artificial intelligence allows attackers to regenerate traps and malware in hours instead of weeks. In the GTG-1002 campaign announced by Anthropic, the 80-90 percent of the artificial intelligence attack was carried out with multiple requests per second, which speed is impossible for human teams.

What is the ClickFix attack and how does it work?

ClickFix is a trap method that uses fake CAPTCHA or verification pages. The user self-made a Cloudflare or Zoom verification and runs the given command with his own hands. This command starts loading of malware in the background. GreyVibe used this method in PhantomClick chain.

What to do to protect from GreyVibe attacks?

The basic steps that do not open archive files from sources that you do not recognize, run commands that fake verification pages want and enable multi-factor authentication in every account. Minimum privilege principle for institutions, activity record and early warning systems are recommended.

Is GreyVibe directly connected to the Russian state?

WithSecure states that the group does not have enough evidence to connect directly to the Russian state. The researchers evaluate the group’s connection with the cybercrime ecosystem with moderate confidence. The group is positioned in a gray area between cyber crime and state-related activity.

WithSecure’s relationship with the GreyVibe of the DroneLink chain followed by is still researched. As the role of artificial intelligence on the attack side is deepened, the defense side will be seen in the next months, which will adapt to the same means.