Hacker uses Google Gemini CLI to control botnet of dental clinic PCs

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI to commandeer a botnet of eight dental clinic PCs. Analysis of 200 session logs between March 19 and April 21, 2026, revealed the AI-powered operation.