AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection
Morphisec warns AI-driven malware like PROMPTFLUX rewrites its code hourly via the Gemini API, eroding signature-based detection.
Morphisec analysts reviewed Google's late-2025 disclosure of PROMPTFLUX, an experimental dropper that queried the Gemini API roughly hourly and generated more than 70 obfuscated variants in under four hours. Related samples PROMPTSTEAL, PromptLock, and BlackMamba use LLMs to generate Windows commands or mutate payloads at runtime. The report argues signature-based controls lose value when every copy differs and recommends prevention-first execution controls and behavior-based detection.
- PROMPTFLUX queried the Gemini API about hourly, producing 70+ obfuscated variants in under four hours.
- AI-assisted whole-block code replacement approaches metamorphic behavior, leaving no stable core to fingerprint.
- PROMPTSTEAL, PromptLock, and BlackMamba also use LLMs for command generation and payload mutation.
- Morphisec recommends prevention-first execution controls, patching, scripting restrictions, and behavioral detection over hash matching.
From the original article
3 min read at cybersecuritynews.com
AI-powered malware is making a familiar security problem harder to contain. Instead of keeping the same code long enough for antivirus tools to recognize it, these programs can alter their form repeatedly while retaining the same harmful purpose. The emerging model relies on large language models as an automated code factory.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.