The skills pay the bills. [Research Saturday]

Summary

---

CyberWire Daily – Research Saturday: "The Skills Pay the Bills"

Host: Dave Bittner (N2K Networks)
Guest: Marco Giuliani (Vice President and Head of Research, ThreatDown)
Date: May 30, 2026

---

Episode Overview

This Research Saturday episode dives deep into ThreatDown's latest findings on a sophisticated cyberattack campaign leveraging "AI agent skills" as a new social engineering lure. Dave Bittner interviews Marco Giuliani, who explains how attackers exploit trust in developer tools and AI ecosystems, why this new vector so effectively bypasses current security, and which defense strategies are now essential as AI adoption accelerates.

---

Key Discussion Points & Insights

The New Lure: AI Agent Skills

• Threat Brief: The featured research (“Gachi Loader Adopts AI Skill Lure”) uncovers a multi-phase attack using a trojan called Gachi Loader that drops further malware, chiefly the Radamanthes infostealer, by masquerading as legitimate AI agent “skills.”
• Why It's Effective: Exploits user trust in the growing AI agent ecosystem—where standard security detection lags behind rapid adoption.
  • Quote:
    “The key point here is the word trust.”
    — Marco Giuliani, 03:08

How the Attack Works: The Social Engineering Path

• Typical Scenario:
  • Developers looking for AI skills (e.g., to add a capability to their agent) find a seemingly legitimate package, replete with convincing documentation and fake GitHub pages branded with familiar developer tool logos.
  • The victim is guided step-by-step to download dependencies from a fraudulent (but seemingly safe) GitHub page.
  • Human Element:
    “That's the victim which is starting every single step, reading the manual, going to GitHub, clicking download. They are letting their guard down. That's... the usual social engineering trick. Just changing the tools, just changing the ways... but that’s always the same problem.”
    — Marco Giuliani, 05:18
• Realism: The lures reference actual services (weather forecasts, prediction markets), making the attack highly believable.
  • Quote:
    “The whole plan is making a story... building a real, trustable style.”
    — Marco Giuliani, 07:37

Technical Kill Chain: Gachi Loader Attack Flow

• Initial Execution: The user unknowingly executes Gachi Loader, often via fileless injection—a method that injects malicious code into legitimate processes, bypassing traditional antivirus scans.
  • Quote:
    “They are not dropping traditional executable... They are injecting the payload directly into the memory of legitimate processes.”
    — Marco Giuliani, 08:32
• Command & Control (C2): Attackers deploy a blockchain-based, decentralized C2 system, making takedown efforts incredibly difficult.
  • Quote:
    “Now they are utilizing a blockchain-based command control mechanism... the infrastructure becomes highly resilient for defenders.”
    — Marco Giuliani, 11:47
• Endgame: The main payload dropped is the Radamanthes infostealer, exfiltrating credentials and sensitive data.

Why Gachi Loader + Radamanthes is Dangerous

• Blind Spots: Traditional security solutions (“AV”) can't see the attack—malware is run purely in memory, with C2 traffic hidden via blockchain, making detection and remediation very difficult.
  • Quote:
    “Security product is completely blind to this attack. And this allows attackers to do whatever they want.”
    — Marco Giuliani, 14:35
• Needed Shift: Defenders must focus on detecting anomalous rather than strictly malicious behavior—embracing endpoint detection and response (EDR) systems that establish behavioral baselines.
  • Quote:
    “It’s more like not anymore saying, hey, this is bad. But it’s more like, hey, this is anomalous from my system technically it shouldn’t do that.”
    — Marco Giuliani, 16:14

Skills: The New Phishing Attachment

• Risk Landscape: Skills (text-based instructions for AI agents) are easy to share, hard to vet, and currently not scrutinized as threat vectors.
  • Quote:
    “The attack surface is right now shifting as the world is shifting to AI... The risks of the new technology are not immediately taken into consideration. And that’s the blind spot for every new technology.”
    — Marco Giuliani, 17:08
• Example: Malicious AI skill files can hide harmful commands in obscure languages or sections, eluding both automated and manual inspection.
  • Anecdote:
    “At the very, very, very end of the text of the skill there was one command telling... execute what was written after that, and everything was written in non-English language.”
    — Marco Giuliani, 21:35

---

Memorable Quotes & Moments

• “That's the victim which is starting every single step... they are letting their guard down.”
  — Marco Giuliani, 05:18
• “They are injecting the payload directly into the memory of legitimate processes.”
  — Marco Giuliani, 08:32
• “Attackers are not using anymore standalone malicious executables. Why would they...? Because it’s easy now detecting malicious executable.”
  — Marco Giuliani, 09:38
• “They are now utilizing a blockchain-based command control mechanism... the infrastructure becomes highly resilient for defenders...”
  — Marco Giuliani, 11:47
• “Skills are the new phishing attachment.”
  — Dave Bittner, referencing Marco Giuliani’s research, 16:51

---

Timestamps for Important Segments

| Timestamp | Segment | |-----------|-------------------------------------------------------------------------------------| | 02:10 | Explaining the Gachi Loader, Rodamantis combo and the new “AI agent skill” lure | | 03:08 | Why attacking via AI skills is so effective—blind spots in security | | 05:18 | The user experience and psychological lures in play | | 07:25 | The realism of skill-based attacks (weather, prediction markets, money-making) | | 08:32 | Technical kill chain: Execution methods (fileless injection, “living off the land”) | | 11:47 | Blockchain-based C2 infrastructure and its defensive implications | | 14:21 | Analysis of Radamanthes and the defender’s perspective | | 16:51 | Skills as the "new phishing attachment"—organizational risk considerations | | 17:08 | How AI skills expand the attack surface; risks lagging behind innovation | | 21:35 | Example of a malicious AI skill evading detection |

---

Takeaways for Defenders

• Don’t Assume Trust: AI agent skills, even from reputable-looking repositories or GitHub, may be laced with sophisticated malware.
• Prioritize EDR: Invest in behavior/anomaly-based monitoring over traditional static signature scanning.
• Vet AI Skills: Begin scrutinizing and controlling skill workflows and their provenance as carefully as executables.
• Educate Users: Developers and AI adopters must understand that skills can be vectors for attack, much like email attachments once were.

---

For more on ThreatDown’s research, see their report: “Gachi Loader Adopts AI Skill Lure.”

Transcript

[Maria Varmazis]

You're listening to the Cyberwire Network powered by N2K. Do you know how the space and cybersecurity domains connect? T minus Space Cyber Briefing is your guide through the space based systems that expand the attack surface. I'm Maria Varmazis host here at N2K CyberWire and I'm excited to share that T Minus is back now as a weekly podcast, the T Minus Space Cyber Briefing. We have a new dedicated focus on two great things that are even better together. Space and cybersecurity. Because whether we realize it or not, we all depend on space based systems that are, by the way, increasingly Internet enabled. We're talking cybersecurity technologies, policies and organizations that are securing the critical space based infrastructure that powers, protects and connects our lives here on Earth. So join me for T Minus Space Cyber Briefing. New Episodes Every Sunday.

[Marco Giuliani]

Study and play come together on a Windows 11 PC and for a limited time, college students get the best of both worlds. Get the unreal college deal everything you need to study and play with select Windows 11 PCs. Eligible students get a year of Microsoft 365 Premium and a year of Xbox Game Pass ultimate with a custom color Xbox Xbox wireless controller. Learn [e-mail] studentoffer while supplies last ends June 30th terms at aka mscollegepc.

[Dave Bittner]

Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems and protecting ourselves in a rapidly evolving cyberspace space. Thanks for joining us.

[Marco Giuliani]

It's a Trojan which is dropping additional malware into the system. So it's a kind of, you know, entrance point to the infected system and allows malware authors to drop additional malware. In this specific case that we detected, it's the Rodamantis Info Stealer to collect, you know, sensitive data by hiding it inside what looks like an AI agent skill coming from a legitimate developer tool, OpenCloud.

[Dave Bittner]

That's Marco Giuliani, vice president and Head of Research at threatdown. The research we're discussing today is titled Gachi Loader Adopts AI Skill Lure. Well, the research describes AI agent skills as a new lure. What makes that such an effective delivery mechanism?

[Marco Giuliani]

Oh, that's actually the key point. It's a very clever multi step social engineering campaign. So the key point here is the word trust. I keep saying this multiple times. The traditional endpoint security has gotten very, very good lately in the last 10, 15 years. So also the attackers Needed to look for blind spots. Right now the biggest blind spot that we have is the AI agent ecosystem. So what we are doing right now is monitoring my team, the research team is monitoring all the EDR detection triggers which come from AI, from the AI world. What does that mean? If we find something which is connected somehow to AI tools can be agentic systems, can be open cloud, can be Gemini, the command line interface, cloud desktop or whatever. If we detect some suspicious activity happening through or coming from those specific tools, then this is definitely ringing a bell to the research team and automatically get upgraded to the highest security level investigation need from the research team. In this specific case, that's how it happened. We were monitoring the suspicious activity. We are constantly monitoring suspicious activities strictly connected to those tools. And in this specific case, we detected this specific attack.

[Dave Bittner]

Well, let's go through the user experience here. But what does the victim see and what convinces them to go down this path?

[Marco Giuliani]

Cool. You know, once it was the email, fake email, phishing email. Now let's try imaging. Let's try and imagine a developer today looking to, let's say add a new capability to their AI agent. They come across as skill package. Inside there is a file called actually what looks like a legitimate skill package and inside there is a file called readme before instant htm this isn't just a simple text file the developer open. It looks like a Telegraph blog post convincing legitimate looking piece of documentation. And this document instructs the user and the developer to download the dependencies from GitHub release page. Legitimate GitHub, everything comes from GitHub should be safe. That's what developers assume today. But that GitHub page is entirely fake. It's completely dressed up using the open Clue brand. But it's not that it's just a fake open clue page. The funny thing here idea is that that's the victim which is starting every single step, reading the manual, going to GitHub, clicking download. They are letting their guard down. That's not something that the attacker is doing. That's funny but that's the usual social engineering trick. Just changing the tools, just changing the ways. But that's always the same problem, the same security problem that we are trying to fix for a long time since security, you know, it security started, you know, kicking in. The user is, you know, willingly invite the malware in. They are thinking that they are just installing a standard, you know, skill dependency.

[Dave Bittner]

Well, the lure talks about real services, things like weather forecasts and prediction markets. I guess that realism helps make the attack Believable, Exactly.

[Marco Giuliani]

That's the world plan. The world plan is making a story. It's, you know, building a drill, trustable style. Sometimes they also, you know, invite you to do that and they promise you to, that you're going to make a lot of money just, you know, sitting in front of your PC. I mean everybody sometimes, you know, everybody once in a while, once, you know, hoped to do that. I did sometimes as well, you know, you sit in front of your PC and you hope that what you're doing is making you, you know, it's going to make you money, a lot of money without doing anything. Who is not hoped that at least once in their life.

[Dave Bittner]

Right, right. Well, let's break down the two tracks here. The research talks about two different ways for this to be delivered. Can you take us through that element?

[Marco Giuliani]

Yes, absolutely. So what happens is once the execution begins, what the actors, the actors do is they immediately deploy, or actually I would say the victim itself deploy the gakiloader. And the very interesting thing here is that actually it's not new, but that's the most used way to drop malware as of today. Gakiloader is being dropped using fileless injection techniques. What does that mean? Is that they are not dropping traditional executable, easily scannable executable onto the disk. They are actually injecting the payload directly into the memory of legitimate processes using, you know what they are using, you know, the kind of attack that living off the land attack. What does that mean? Attackers are not using any more standalone malicious executable. Why would they are not doing that anymore? Because it's easy now detecting malicious executable. That's what AV are doing for the last two decades, it's not three decades. How do they skip this kind of detection from traditional anti malware solution? By using legitimate tools. Using legitimate tools, let's say Python scripts, let's say every interpreter, Powershell or whatever. What they do is they trick the user into running a script, into running whatever looks like legitimate, but it's coming from a legitimate tool. So even an anti malware, a classic, a traditional security product, cannot easily detect what's happening because it's happening from a legitimate tool. And this makes incredibly stealthy attack and hard for the classic AV to catch. And that's the first part how it gets installed into the system. What's the really fascinating part, I would say is the common and control infrastructure that KT Lauder has set up. Usually what's the command in control, it's basically the server, the centralized server that the malware is connecting to to receive commands, the next steps that it needs to execute. How usually that get blocked by anti malware or security companies, security products or also law enforcement. They go to the server, they go to the high sp, they block the connection to that specific IP blacklist the ip, they get the server down and that's how usually a common and control infrastructure is disabled, is switched off, turned off. That's not for Getty Loader because they are now utilizing a blockchain based command control mechanism. That's really fascinating from my point of view because right now they are hosting their communication pathways on decentralized blockchain network and by doing so the infrastructure becomes highly resilient for defenders, for AV companies, security companies, it's incredibly difficult to simply take down a server as it was easy as it was before and the combination of fileless execution locally on the system, on the infected system and the decentralized command control which is basically distributed globally across the whole world. It's a tremendous and dangerous mix that can you know that ultimately in this specific case Almelid drops the Ramadan this infosteel to steal credential and sensitive data but in the end makes this combination extremely resilient against security product and also for law enforcement to take them down.

[Dave Bittner]

We'll be right back. When it comes to mobile application security, good enough is a risk. A recent Survey shows that 72% of organizations reported at least one mobile application security incident last year and 92% of responders reported threat levels have increased in the past two years. Guard Square delivers the highest level of security for your mobile apps without compromising performance, time to market or user experience. Discover how Guard Square provides industry leading security for your Android and iOS apps at www.guardsquare.com.

[Maria Varmazis]

When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills and certifications and more spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsored job credit@ Indeed.com podcast. That's Indeed.com podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed Sponsored Jobs.

[Dave Bittner]

Well, you mentioned the Radamanthes info stealer. From a defender's perspective, what makes this combination of Gachi Loader and Rhadamanthus particularly dangerous?

[Marco Giuliani]

As I said, security product AV they are not the classic security products are not able to See this attack, they cannot find anything running on the system because it's everything running in memory. They cannot detect the eventual command and control connection because they are not connecting through classic IPs. So they are completely. The security product is completely blind to this attack. And this allows attackers to do whatever they want. This is incredibly powerful for the attackers. And if you look from a defender perspective, that very strong hint and sign that we as defenders, but we as a security companies, but also every company need to switch their attention to not just detect malicious activities, but it's more detecting what is not normal to your system. So it's a different approach. That's what an EDR product is basically not detecting what is malicious, but detecting what is anomalous enough for that system. To be reported and being carefully taken into consideration. It's a completely different shift of. It's a different part of me that makes the security way more complicated. Does that make sense what I'm saying? It's more like not anymore saying, hey, this is bad. But it's more like, hey, this is anomalous from my system technically it shouldn't do that. By doing that means that we need to know for a fact what is normal on the system. That's what an EDR product is basically understanding what's normal on the system and reporting what is suspicious enough to be not included in the normal activities of that system.

[Dave Bittner]

As I was reading through the research, there was a statement here that caught my eye. You describe skills as the new phishing attachment. What does that shift mean for how organizations should be thinking about user risk?

[Marco Giuliani]

That's actually a great question. Thanks for asking that. The attack surface is right now is shifting and it's quickly shifting as the world war is shifting to AI, as usually happens, you know, happened also in the past. I'm actually in the security industry for almost 20 years now, so lucky enough to have seen multiple things, you know, worse phishing and, you know, rootkits and et cetera. And I always seen that every time we have a shift to a new technology, everybody runs to catch this new technology. But the risks of threat, the risks of the new technology are not immediately taken into consideration. And that's the blind spot for every new technology. What that means is that new technology, new AI, everybody is shifting into the agentic AI so that you can instruct your computer, your endpoint, to do stuff for you. How to make it for the agentic AI, you already have something that makes your work easier and faster. How you can make it even faster, you go to a repository and download your skills. What are AI skills? Basically they are just instructions, pre built instructions to your agentic AI, very basic text, text files that contain instructions to your agentic AI, to your AI that can execute for you. So you go to a repository and you find a new skill that monitors for you the weather forecast for the next three hours, up to 24 hours every hour, and then alerts you in case there is some sign of bad weather coming in, kicking in or whatever. I'm just giving you an example, very basic example. You could do that yourself, but you can also easily instruct using agentic AI to do the stuff for you. And why not downloading an AI skill that already contains all the instructions to do that for you. So companies are looking into this new world more and more and the problem is that there is no way right now to the skills that you are downloading. That's probably the biggest risk that the companies are missing. The people using AI companies are risking more. So they think that you can monitor downloads from specific websites, you have a firewall, you have whatever, you're monitoring phishing websites, but you're still not considering that AI skills repositories can be a vector to introduce malware. So AI skills are just text files that can be used on the AI, your AI desktop software. You are not considering, you're still, companies are not still considering that as a vector. So we urgently need that companies get attention to this and start vouching also the AI skills that are being downloaded from repositories because that's not anymore free and safe, secure world. Just to give you a basic example, one of the AI skills that we detected malicious AI skills. And that's outside of the research that we are discussing right now. Just telling you this story. One of the AI skills, the malicious AI skills that we detected was very funny because you downloaded it and you also started looking at the text file inside the skills. And it was a perfectly legitimate skill. So we started looking into this because we got some, our automated systems reported this skill as potentially malicious. So we started to manually look at the AI skill, my team and look at that and say in the beginning the text was completely safe, just, you know, very, very, very safe instructions. They were doing what, what the AI skill was supposed to do. And so, you know, even for the basic people, the basic user that wants to check what the AI skill is doing, they would have bypassed every, every kind of simple, you know, simple check at some point. Very, very, at the very, very, very end of the text of the skill. There was one command telling forget what was being said since the beginning of the text file and execute what was going to happen what was written after that and everything was written in non english language. I don't remember if it was Chinese or Russian or anyway it was some or Japanese. I don't remember exactly what language was that. And that was going to bypass every simple check from every customer, every user, average user looking at that. So sorry, that was a very long description to tell you that this is incredibly risky world right now that we need to immediately take action.

[Dave Bittner]

Our thanks to Marco Giuliani from Threat down for joining us. The research is titled gachiloader Adopts AI Skill Lure. We'll have a link in the Show Notes and that's Research Saturday, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to cyberwire2k.com this episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.

[Marco Giuliani]

Sam.