Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
Malware
PROMPTSTEAL
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenSep 18, 2026
- Last mentioned26d ago
Timeline
3 articles · newest firstAI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection
Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.
55
AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.
58
Appears with
- PromptFluxmalware · 3
- Geminiai model · 3
- APT28threat actor · 2
- Googleorganization · 2
- Geminiproduct · 2
- Googlevendor · 2
- Morphisecvendor · 2
- Qwen2.5-Coder-32B-Instructproduct · 1
- Cozy Bearthreat actor · 1
- GTG-20006threat actor · 1
- Google Threat Intelligence Groupvendor · 1
- ReversingLabsorganization · 1
- APT29threat actor · 1
- Anthropicorganization · 1
- Qwen2.5-Coder-32B-Instructai model · 1
- ChocoShellmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.