Malware

PROMPTSTEAL

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 18, 2026 · last 8h ago

Timeline2 articles

AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection

Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.

Morphisec analysts reviewed Google's late-2025 disclosure of PROMPTFLUX, an experimental dropper that queried the Gemini API roughly hourly and generated more than 70 obfuscated variants in under four hours. Related samples PROMPTSTEAL, PromptLock, and BlackMamba use LLMs to generate Windows commands or mutate payloads at runtime. The report argues signature-based controls lose value when every copy differs and recommends prevention-first execution controls and behavior-based detection.

Cyber Security News08:12 UTC · 8h agoMalware in the wild 2 sources

AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection

Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.

Google Threat Intelligence Group documented 'just-in-time' AI-enabled malware that queries language models during execution. PROMPTFLUX, an experimental VBScript dropper, calls the Gemini API to regenerate and obfuscate its own source code and writes variants to the Windows Startup folder for persistence. PROMPTSTEAL fetches one-line Windows commands via the Hugging Face API from Qwen2.5-Coder-32B-Instruct to collect files and system information, which Google linked to APT28 activity targeting Ukraine. The article argues signature-based defenses retain value but defenders should prioritize behavioral detection and deterministic prevention controls.

GBHackersupdated 08:12 UTC · 8h agofirst 05:23 UTC · 10h agoMalware in the wild 2 sources

Appears with

ai model Gemini 2 product Gemini 2 malware PROMPTFLUX 2 vendor Morphisec 2 organization Google 1 threat actor APT28 1 organization Morphisec 1 product Qwen2.5-Coder-32B-Instruct 1 vendor Google 1 vendor Google Threat Intelligence Group 1 vendor Hugging Face 1 organization Google Threat Intelligence Group 1 malware BlackMamba 1 malware PromptLock 1 ai model Qwen2.5-Coder-32B-Instruct 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.