AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.
58
Vendor
Google Threat Intelligence Group
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 1, 2026
- Last mentionedSep 18, 2026
Timeline
7 articles · newest firstAttackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
82
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.
65
Threat actors are giving AI agents a bigger role in cyberattacks
Google Threat Intelligence's Q3 2026 tracker shows threat actors using AI agents for autonomous credential harvesting, including a six-hour campaign compromising thousands of credentials.
62
AI Coding Tools Now a Prime Target for Threat Actors, Google Warns
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
75
IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
68
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Google Threat Intelligence details BREEZE COMET, a financially motivated group manipulating Brazilian payment systems and banking software to conduct fraudulent transfers since 2024.
55
Related CVEs
by mentions- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
Appears with
- Mandiantvendor · 3
- Googleorganization · 3
- UNC6780threat actor · 2
- Google Threat Intelligence Grouporganization · 2
- Geminiai model · 2
- Geminiproduct · 2
- PyPIvendor · 1
- Volexityvendor · 1
- NodeMavenvendor · 1
- Exchangeproduct · 1
- Claudeproduct · 1
- Windowsproduct · 1
- financially motivated threat actorthreat actor · 1
- mining companiesvictim · 1
- Docker Hubproduct · 1
- npmvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.