ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Qwen2.5-Coder-32B-Instruct

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection

Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.

Google Threat Intelligence Group documented 'just-in-time' AI-enabled malware that queries language models during execution. PROMPTFLUX, an experimental VBScript dropper, calls the Gemini API to regenerate and obfuscate its own source code and writes variants to the Windows Startup folder for persistence. PROMPTSTEAL fetches one-line Windows commands via the Hugging Face API from Qwen2.5-Coder-32B-Instruct to collect files and system information, which Google linked to APT28 activity targeting Ukraine. The article argues signature-based defenses retain value but defenders should prioritize behavioral detection and deterministic prevention controls.

GBHackersupdated · 9h agofirst · 11h agoMalware in the wild 2 sources

Appears with

threat actor APT28 1malware PROMPTFLUX 1malware PROMPTSTEAL 1ai model Gemini 1ai model Qwen2.5-Coder-32B-Instruct 1organization Google Threat Intelligence Group 1product Gemini 1vendor Google Threat Intelligence Group 1vendor Hugging Face 1vendor Morphisec 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.