ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

BlackMamba

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection

Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.

Morphisec analysts reviewed Google's late-2025 disclosure of PROMPTFLUX, an experimental dropper that queried the Gemini API roughly hourly and generated more than 70 obfuscated variants in under four hours. Related samples PROMPTSTEAL, PromptLock, and BlackMamba use LLMs to generate Windows commands or mutate payloads at runtime. The report argues signature-based controls lose value when every copy differs and recommends prevention-first execution controls and behavior-based detection.

Cyber Security News · 9h agoMalware in the wild 2 sources

Appears with

malware PROMPTFLUX 1malware PromptLock 1malware PROMPTSTEAL 1ai model Gemini 1organization Google 1organization Morphisec 1product Gemini 1vendor Google 1vendor Morphisec 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.