AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection

AI-powered malware is beginning to erode one of endpoint security’s oldest assumptions: that malicious code will remain stable long enough to identify, fingerprint, and block.

A new class of threats uses large language models during execution to rewrite scripts, generate commands, and alter obfuscation on demand producing variants that can evade static hashes and traditional antivirus signatures before defenders can create a rule for them.

The finding moves AI abuse beyond phishing copy, reconnaissance and malware development assistance: the model itself becomes an operational component of the intrusion chain.

PROMPTFLUX, an experimental VBScript dropper discovered by GTIG in June 2025, communicates with the Gemini API to request fresh obfuscation and evasion techniques.

Its notable component, described as “Thinking Robot,” can ask the model to regenerate its source code at intervals, enabling self-modification designed to frustrate static signature-based detection.

The regenerated code can then be written into the Windows Startup folder, coupling evasion with persistence.

That distinction matters. Classic polymorphic malware commonly changes encryption keys, packers or superficial code elements while retaining a recognizable decryption routine or payload structure.

The objective is not necessarily fully autonomous malware reasoning; it is cheap, rapid variation at machine speed.

PROMPTSTEAL demonstrates a related model of operation. GTIG reported that the malware uses a Hugging Face API query to obtain one-line Windows commands from Qwen2.5-Coder-32B-Instruct, then executes those commands to collect files and system information.

Google described it as its first observation of malware querying an LLM in live operations; reporting linked its use to APT28 activity targeting Ukraine.

Signature-based security remains effective against known, stable malware samples.

It can match hashes, byte patterns, YARA-like content rules, certificate reputation, known command strings and recurring file structures. But each of those approaches assumes some component remains constant.

Self-rewriting malware attacks that assumption directly. If an implant requests a newly obfuscated version of its code every hour, a hash denylist becomes obsolete immediately.

If a stealer creates commands dynamically rather than embedding them in its payload, simple string-based detection loses visibility.

If the code is generated only after the malware has begun running, static analysis may see only a loader, a benign-looking script or encrypted instructions.

Google’s Threat Intelligence Group (GTIG) documented, this shift in its research into “just-in-time” AI-enabled malware, identifying families including PROMPTFLUX and PROMPTSTEAL that query language models while running.

AI-powered malware

The issue is therefore not that all signature-based defenses suddenly stop working. Rather, their coverage narrows to known artifacts, infrastructure and techniques.

AI-assisted malware can instead outsource portions of its transformation logic to an external model, generating syntactically different but functionally similar scripts as needed.

Analysts can still detect suspicious parent-child process chains, anomalous API access, persistence creation, unusual outbound connections to AI services, credential-access activity and data staging. But the payload itself can become an unreliable anchor for detection.

This evolution also extends the established challenge posed by fileless and in-memory attacks, where malicious logic avoids a conventional executable on disk.

AI-driven mutation makes the code layer more disposable, while living-off-the-land utilities and generated commands can make execution blend into normal Windows activity.

Organizations should not treat AI-polymorphic malware as a reason to abandon detection engineering.

Instead, they need to reduce dependence on file identity and increase emphasis on execution context, attack paths and policy enforcement.

Endpoint telemetry should prioritize behavior that remains difficult for an attacker to change without compromising the attack: script engines launching unusual child processes, Office applications spawning shells, persistence changes, credential-store access.

Network teams should also monitor endpoints reaching generative-AI services where such access is unnecessary or inconsistent with policy.

The most durable control is preventing dangerous execution paths before a payload’s reputation is known.

Application control, attack surface reduction rules, script restrictions, least privilege, protected credential stores, memory-exploit defenses and rapid patching can limit the conditions under which a freshly generated variant succeeds.

The strategic lesson from PROMPTFLUX and PROMPTSTEAL is that defenders cannot rely solely on recognizing previously seen code.

AI lowers the cost of generating endless cosmetic and functional variations, while security teams still face validation, deployment and false-positive constraints.

Security programs should combine behavior-based detection with deterministic prevention controls that do not require a prior hash, signature or model verdict.

Runtime protections such as moving-target defenses aim to disrupt exploitation and malicious memory activity even when the exact payload is unknown.

Morphisec, for example, positions its Automated Moving Target Defense as a prevention-focused approach that changes runtime conditions rather than attempting to identify every new sample.

AI-enabled malware is still developing, and PROMPTFLUX was described by Google as experimental.

Yet the operational significance is clear: the malware ecosystem is learning to treat AI as a live code-generation service. Defenders must now assume that the sample they analyze may not be the sample that executes tomorrow.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC