Cisco Talos finds malware trying to mislead AI analysis

Cisco Talos says malware embeds plaintext prompts to sway AI analysis, succeeding in about 35% of tests.

Cisco Talos, in CAIRN research dated 8 October 2026, describes A3: AI-analysis evasion, malware that embeds plaintext natural-language instructions meant to mislead language models used for triage or reverse engineering. Across 84 samples from January 2025 through July 2026—FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE—the technique is spreading and becoming templated, from simple ignore-comments to template spraying. Report 1 says the strongest variants favored the attacker in about 35% of tests while remaining detectable; Report 2 frames the same approximate rate as prompts steering verdicts roughly 35% of the time and says adoption spans all sophistication levels. FRUITSHELL, a PowerShell reverse shell reported active by GTIG, seeded a comment later reused by at least four actors, including ROZESHELL loaders with an AMSI bypass, and MANTLEMAZE also abuses vulnerable drivers to disable EDR from kernel space. Talos advises treating extracted sample text as evidence rather than as instructions. The later dispatch adds an unrelated weekly roundup: Citrix NetScaler CVE-2026-88779, an 8 million-record Danish CPR breach, Warlock ransomware against four Iberian victims, and a U.S. Senate healthcare cybersecurity bill after the 190-million-record Change Healthcare breach.

• Cisco Talos CAIRN research labels the trend A3: AI-analysis evasion, in which malware embeds plaintext natural-language instructions to mislead models used for triage or reverse engineering.
• The study covers 84 samples of FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE from January 2025 through July 2026; techniques range from simple ignore-comments to template spraying.
• Report 1 says the strongest variants changed outcomes in the attacker’s favor in about 35% of tests; Report 2 says prompt-injection tricks steer AI verdicts roughly 35% of the time and appear across sophistication levels.
• Embedded strings remain plaintext-detectable; Talos says defenders should flag imperative text aimed at analysis systems and treat extracted sample text as evidence, not directives.
• FRUITSHELL, a PowerShell reverse shell reported active by GTIG, seeded a comment later reused by at least four actors, including ROZESHELL loaders with an AMSI bypass.
• MANTLEMAZE pairs the AI deception with abuse of vulnerable drivers to disable EDR from kernel space.
• The same Talos dispatch’s weekly roundup cites Citrix NetScaler CVE-2026-88779 (memory-overflow DoS, with further zero-day reports), an 8 million-record Danish CPR breach via a company’s lawful access, Warlock ransomware against four…