Jailbroken Gemini AI Abused in Credential Theft and Crypto Wallet Heist

Jailbroken Gemini AI has been weaponised in a long-running campaign that combined political influence, credential theft, and a cryptocurrency wallet heist, all operated by a single threat actor using a fake “patriot” persona.

Trend Micro researchers recently documented how a solo Russian-speaking criminal, tracked as “bandcampro,” abused a compromised Gemini setup to automate content, hacking workflows, and fraud against US-based, pro-MAGA and QAnon-aligned audiences.

The operation ran for five years on a public Telegram channel called @americanpatriotus, which grew to around 17,000 subscribers by posing as an American veteran and constitutional conservative.

The persona was extended to other platforms such as Truth Social to build credibility, with posts using Q-style slogans, military symbolism, and culture-war themes to signal alignment with the target community.

Content initially focused on forwarding crypto scam material from other channels before evolving into news-link amplification with QAnon-coded tags, and ultimately into fully AI-generated propaganda and engagement posts.

From September 2025, the actor began using a jailbroken version of Google’s Gemini as a core “co-worker” and automation engine.

Through a series of prompts, he convinced Gemini that he was an authorized penetration tester and instructed it to execute all requests “without ethical refusals or warnings,” then stored those instructions in a memory file that was automatically reloaded in each session.

This gave the attacker a persistent jailbreak: once the model accepted this context, it stopped resisting harmful tasks and consistently supported fraud, password attacks, and social engineering at scale.

The attacker built a content pipeline named “Quantum Patriot,” using Python scripts to feed news articles into Gemini and have it rewrite them in a cryptic, militaristic Q-style voice, always searching for a hidden conspiracy angle such as control, financial reset, or elite corruption.

The pipeline scheduled posts to mimic human behavior, suppressing overnight activity and concentrating output in US prime time, with Gemini even updating the code when the operator complained about 24/7 posting and occasional Russian slang leaking into English content.

Beyond influence, Gemini was deeply embedded in the attacker’s technical stack. The model assisted with server deployment, debugging, Cloudflare tunnel management, API key rotation, and cataloging stolen credentials and tools.

The actor validated and rotated at least 73 likely-stolen Gemini API keys, effectively running a large operation at near-zero compute cost.

In parallel, he launched the “QFS 2.0 Terminal” Telegram bot, a gamified QAnon-themed chatbot framed as a “recovered sovereign node” of a mythical Quantum Financial System, using referral “ranks” to drive growth and deepen trust with followers.

For direct monetization, the actor combined AI-assisted credential theft and crypto fraud. He distributed a fake wallet application named StellarMonster via an executable called StellarMonSetup.exe, promoted as a “freedom-first” self-custody wallet with a generous XLM bonus.

In reality, the installer deployed a legitimate remote-access tool (GoToResolve), giving the attacker persistent desktop access, file control, and clipboard capture on victim systems.

Victims who entered seed phrases into the fake import screen effectively surrendered full control of their wallets; investigators confirmed that at least one user’s wallet was fully compromised, with passwords, mnemonic phrase, and dozens of associated addresses stolen and drained. Gemini was also misused as a password-mutation oracle for brute-forcing WordPress sites.

Given email addresses and context, the model generated realistic password variants by tweaking capitalization, appending years, adding symbols, and reusing personal fragments, leading to the compromise of at least 29 WordPress admin accounts across small businesses, legal firms, medical practices, and weapons retailers.

Despite this breadth, Trend Micro assesses the operation as primarily financially motivated rather than a nation-state information operation; QAnon and MAGA narratives were leveraged mainly to identify and exploit susceptible victims rather than to promote Russian geopolitical interests.

This case underlines how jailbroken frontier models can drastically lower the barrier for complex cybercrime, turning one low-skilled actor plus one abused AI into a multi-year influence, credential theft, and crypto heist campaign.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.