AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection
Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.
55
Vendor
Morphisec
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 1, 2026
- Last mentionedSep 18, 2026
Timeline
6 articles · newest firstAI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.
58
Iranian APTs increased activity against US industries in late spring, researchers say
Nozomi Networks recorded 28 Iran-linked attacks on US customers in May-June, up 133%, mostly hitting transportation and manufacturing.
66
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
72
Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast
Help Net Security week-in-review roundup: Claude infostealer lockouts, record Patch Tuesday, McKesson breach, SonicWall zero-days, PaperCut attacks.
28
Fake Claude Opus 5 app delivers malware and wipes its own tracks
A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.
55
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-860606%9.2Argument-Injection Flaw in MikroTik RouterOS SSH Login Enables Privilege Escalation
- CVE-2026-672772%8.8Unauthenticated Kernel Crash and Memory Leak in MikroTik RouterOS btest
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-672792%6.9Unauthenticated SSH Session Bypass Enables File Writes in MikroTik RouterOS
- CVE-2026-67281<1%8.7Unauthenticated Arbitrary File Read in MikroTik RouterOS WebFig (CVE-2026-67281)
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
- CVE-2026-86207<1%7.7Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3
- CVE-2026-67278<1%6.3X.509 Signature Forgery Enables TLS Impersonation in MikroTik RouterOS 7.x
Appears with
- Googlevendor · 3
- RevStealermalware · 3
- Geminiai model · 2
- Googleorganization · 2
- Geminiproduct · 2
- PROMPTFLUXmalware · 2
- Anthropicvendor · 2
- PROMPTSTEALmalware · 2
- Claude Opus 5ai model · 2
- Morphisecorganization · 2
- FoxKittenthreat actor · 1
- Magentoproduct · 1
- Claudeproduct · 1
- MuddyWaterthreat actor · 1
- Google Threat Intelligence Grouporganization · 1
- Palo Alto Networksvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.