NullBulge's AI-Powered Malware Allegedly Compromises Disney Employee and Internal Data

A Disney employee, Matthew Van Andel, reportedly downloaded AI-powered malware allegedly developed by the cybercriminal group NullBulge, resulting in a major cybersecurity breach. Hackers purportedly accessed Disney's Slack system, exposing 44 million internal messages, employee and customer data, and financial records. NullBulge also reportedly leaked Van Andel’s personal financial information, leading to identity theft and his eventual termination.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The threat actors targeted the AI software supply chain by injecting malicious code into legitimate AI repositories and libraries on GitHub and Hugging Face.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The attack resulted in the exfiltration and public leak of 44 million internal Disney Slack messages and the employee's personal credentials.
• 4.3 Fraud, scams, and targeted manipulation: The hackers used the stolen credentials to extort the employee and commit financial fraud by racking up bills on his credit cards.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by malicious human actors (NullBulge) intentionally distributing malware disguised as AI tools to steal data.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The underlying AI systems are used for entertainment and simple utility applications like image generation and description, which pose low or negligible risks under the Act.

AI system and alleged parties

• AI system: AI image generator, GPT-4 Vision (OpenAI)
• AI purpose: Image Description; Visual Art Generation
• Behaviour type: Tool
• Alleged developer: NullBulge
• Alleged deployer: NullBulge
• Alleged harmed parties: Matthew Van Andel, Disney employees, Disney

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Substantial
• Psychological: direct Negligible, indirect Minor
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes financial losses suffered by the employee.

Indirectly caused: The employee lost approximately $200,000 in bonuses, lost his health insurance, and had unauthorized charges run up on his stolen credit cards.

Inferred additional harm: Disney likely incurred millions of dollars in financial losses due to forensic investigations, security remediation, and the decision to migrate away from Slack.

Malicious content

Reported: The report explicitly describes malicious content and offensive language spread during the incident.

Directly caused: The threat actors distributed malicious trojanized libraries and malware payloads via public repositories.

Indirectly caused: Strangers used the leaked credentials to post offensive language on the victim's social media accounts.

Privacy

Reported: The report explicitly describes massive privacy violations caused directly and indirectly by the incident.

Indirectly caused: The hackers exfiltrated and published 44 million internal Disney Slack messages, employee passport numbers, the victim's Social Security number, financial account logins, and Ring camera credentials.

Inferred additional harm: Thousands of Disney employees and potentially customers had their private communications and personally identifiable information exposed to the public.

Psychological

Reported: The report explicitly describes psychological harm suffered by the compromised employee.

Indirectly caused: The employee suffered severe anxiety, panic attacks, sleeplessness, and a profound 'sense of violation' following the hack, extortion, and loss of his job.

Inferred additional harm: Other Disney employees whose private messages and passport numbers were leaked may have suffered significant distress and anxiety.

People affected

• Occurrences reported: 1
• People reportedly harmed: 1
• People reportedly exposed: 1

Potential causes

Management

• Inadequate Risk Assessment: Failure to prevent home computers from serving as corporate backdoors.
• Account Takeover Vulnerability: Lack of strict device posture checks for accessing internal Slack channels.

Technology

• Trojanized AI Libraries: Fake OpenAI/Anthropic libraries contained infostealers.
• Malicious AI Image Tools: Free AI software on GitHub contained hidden info-stealing malware.
• Insecure Discord Webhooks: Exfiltration of stolen credentials via encrypted Discord webhook URLs.

Data Inputs

• Compromised Session Cookies: Session cookies harvested from browsers allowed Slack access without 2FA.
• Stolen OpenAI API Keys: Stolen API keys were sold on underground forums, compromising AI access.
• Malicious Dependencies: requirements.txt was modified to force install malicious custom wheels.

Human Factors

• Downloading Unverified Software: Employee downloaded unverified AI tools from GitHub on a personal computer.
• Lack of 2FA on Password Manager: 1Password account lacked 2FA, enabling total credential compromise.
• Poor Home-Work Separation: Using home PC with corporate credentials for experimenting with AI tools.

Process and Methods

• Lack of Code Review: Failure to inspect third-party AI repositories and dependencies.
• Inadequate Credential Rotation: Lack of regular rotation and monitoring of active corporate credentials.

Regulatory Environment

• Low Scrutiny on Open Source: Public AI repositories lack security standards and active verification.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from SentinelOne and the Wall Street Journal provide highly detailed, complementary technical and personal accounts of the supply-chain attack and its consequences.
• Ambiguities identified: There is minor ambiguity regarding whether the AppleBotzz identity is the same entity as NullBulge, but this does not affect the core facts of the incident.

A cybercriminal group compromised a Disney employee using malware disguised as AI utilities, leading to a 1.2TB corporate data leak. While the incident highlights emerging risks in the open-source AI software supply chain, its national security impact is minor, representing corporate espionage and data theft rather than a threat to national infrastructure, sovereignty, or intelligence.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: NullBulge

Threat characteristics

• Imminence: Long-term. The active breach has concluded, leaving behind strategic lessons regarding AI software supply chain vulnerabilities rather than an active, immediate crisis.
• Autonomy: Human-controlled. The AI system acted as a passive lure within the trojanized software; human actors designed the malware and executed the data theft.
• Novelty: Evolved capability. Leverages established software supply chain attack methods but adapts them to target the rapidly growing and unverified open-source AI tool ecosystem.

Impact by dimension

• Physical security: Negligible. The incident targeted a private entertainment corporation and did not affect physical systems, critical infrastructure, or human safety.
• Information security: Minor. While a massive corporate data leak occurred, it involved internal corporate communications and personal data of an entertainment firm, not national intelligence or state-sponsored information warfare.
• Sovereignty: Negligible. The breach was limited to a private corporation and did not impact state authority, electoral systems, or core government operations.
• Economic security: Minor. The breach caused corporate financial loss and highlighted vulnerabilities in open-source AI software supply chains, but did not threaten strategic national industries or macroeconomic stability.
• Societal stability: Minor. The leak caused significant privacy violations for affected Disney employees whose personal data was exposed, but had no broader impact on societal stability or population-scale human rights.