Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
Malware
PROMPTFLUX
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenAug 26, 2026
- Last mentioned16d ago
Timeline
4 articles · newest firstAI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection
Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.
55
AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.
58
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
55
Appears with
- Geminiai model · 4
- APT28threat actor · 3
- PromptStealmalware · 3
- Googlevendor · 3
- Morphisecvendor · 2
- Geminiproduct · 2
- Googleorganization · 2
- Coral Sleetthreat actor · 1
- CaptiveCrunchmalware · 1
- Google Threat Intelligence Grouporganization · 1
- GTG-20006threat actor · 1
- Google Threat Intelligence Groupvendor · 1
- ReversingLabsorganization · 1
- APT29threat actor · 1
- Cozy Bearthreat actor · 1
- Qwen2.5-Coder-32B-Instructproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.