Malware evasion made easier with AI — but behavior still gives it away

Fresh research suggests recent panic over AI-generated malware may be overblown.

Last month Anthropic detailed how Russia-linked cyberespionage group Midnight Blizzard used Claude to rebuild malware each time security tools flagged its backdoor as malign.

“We observed GTG-20006 operate through customized AI-driven workflows that automated much of their operations from development, infrastructure acquisition, phishing, persistence through command and control, to data exfiltration,” the AI company wrote in its report, referring to Midnight Blizzard, aka APT29 and Cozy Bear, as GTG-20006.

While the group’s use of AI as part of its operations is notable, what raised eyebrows was how it did so as part of its evasion strategy: “If their monitoring AI agents identified that any of their deployed malware was detected by a security product, agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections. The agents were designed to continue iterating on GTG-20006’s toolkit until it was undetected,” Anthropic reported.

That autonomous loop — from monitoring for detection to rebuilding the malware to fine-tune evasion — raises the spectre of polymorphic AI malware, malicious software that changes its code structure automatically while keeping the same core functionality.

But threat intelligence company ReversingLabs (RL) has since released a report detailing how its telemetry and behavior-based threat hunting flagged the campaign’s Go backdoor PowerShell stager as malicious on Aug. 1, weeks before Anthropic’s Sept. 10 report.

RL subsequently saw five versions of the same stager over the course of 25 days. Although each had a different hash, all five behaved the same way. That consistent behavior profile left each iteration open to detection, according to a technical blog post by ReversingLabs published last week, as analysts could still hunt for what the malware did and how its files and infrastructure were connected.

As a result, evasion via AI rebuilds may not yet be as foolproof as first feared.

Variations on a well-worn theme

Changing a file to dodge detection is one of the oldest techniques in the business, and polymorphic malware has been deployed to dodge signatures for decades.

“What stands out with this Midnight Blizzard activity is outsourcing the busywork to an LLM,” says Ben Bernstein, manager of the cybersecurity advisors team at managed detection and response firm Huntress. “They wired an AI agent to monitor security tools and automatically generate fresh variants without human intervention. We have seen basic script automation do this, but large language models just make the refactoring cleaner and faster.”

Huntress backs ReversingLabs’ argument that while AI makes malware faster to rebuild it fails to change the hallmarks of its malicious behavior.

“Models are fantastic at scrambling code structure and swapping variables to bypass static analysis,” says Bernstein. “But the AI is not inventing novel exploits. It just automates the grunt work of rewriting the same script to ensure the file hashes change.”

In short, Bernstein says, “the packaging looks different, but the payload’s core objective remains exactly the same.”

Malicious experiments in AI-assisted malware development

Still, AI-assisted malware rebuilding is an emerging if not unprecedented tactic among malware developers.

For example, Google documented PromptFlux in late 2025, an experimental script that asked Gemini to rewrite its own source every hour, and PromptSteal, which APT28 used against Ukraine to generate commands at runtime.

In March 2026, Microsoft released a report describing how the North Korean cluster Coral Sleet is using agentic AI tools to generate, test, and deploy payloads.

“Most of these are early or experimental, and Microsoft’s own assessment is that the capability ‘remain[s] limited by reliability, latency, and operational risk,’” says Igor Lasic, SVP of engineering at ReversingLabs.

But this most recent case involving Midnight Blizzard is the “clearest one on record,” according to Lasic, because two independent sources described the same infrastructure: Microsoft on July 31 as CaptiveCrunch, naming the files CornFlake and ChocoShell, and Anthropic on Sept. 10 with visibility into how the operator used Claude.

“We held both files from July 6 and July 10, before either report,” says Lasic.

Persistent limitations

Still, ReversingLabs’ recent report may reflect only the current state of the art of AI-assisted malware rebuilding, as some of the limitations that characterized the Midnight Blizzard instance could be something more advanced models might overcome, Lasic concedes.

“Today a model rewrites the file for free but cannot cheaply rewrite the server code that parses the beacon, re-register domains or re-phish victims, so the indicators that survived were the ones that had to change in two places at once,” Lasic explains. “A more capable agent with access to the whole operation could coordinate those changes, and I expect infrastructure indicators to age faster over the next few years, the way hashes already have.”

While cost and the availability of more sophisticated models is perhaps only a temporary limit for AI-assisted malware rebuilding, two other limits are closer to fundamental: the behavior of malicious code and clues left behind during a malicious campaign that enable detection.

“An implant that steals credentials has to read the credential store and one that calls home has to open a connection, whatever built it,” says Lasic. “Obfuscation makes that harder to extract, but no rewrite removes a requirement without removing the capability.”

Furthermore, a model can change the next build but not the builds already observed, timestamped and linked to the same server.

“Rebuilding faster produces more artefacts, and each one is another thread back to the operation,” Lasic concludes.

Huntress’ Bernstein backs ReversingLabs assessment that behavior-based hunting will remain effective against even AI-assisted malware development.

“You can disguise malicious code all day, but if a script tries to dump credentials or establish persistence, most modern EDRs [endpoint detection and response tools] will detect the action itself,” says Bernstein.

Another limitation of AI-assisted malware development is that even the latest models are trained to abuse known security vulnerabilities.

“They [AI models] remix known patterns rather than dreaming up zero-days,” Bernstein concludes. “Future models might get better if they can actively test their output against live environments to find undiscovered flaws, but for now, they are just recycling known techniques at a higher speed.”