Google-Documented AI Malware PROMPTFLUX and PROMPTSTEAL Rewrite Their Own Code via LLMs to Evade Signature-Based Detection

Google Threat Intelligence Group documented 'just-in-time' AI-enabled malware that queries LLMs at runtime: PROMPTFLUX, an experimental VBScript dropper that calls the Gemini API to regenerate and obfuscate its own code (roughly hourly, producing 70+ variants…

Google Threat Intelligence Group documented 'just-in-time' AI-enabled malware that queries language models during execution. PROMPTFLUX is an experimental VBScript dropper that calls the Gemini API to regenerate and obfuscate its own source code and writes variants to the Windows Startup folder, coupling evasion with persistence. Morphisec analysts, reviewing Google's late-2025 disclosure, reported that PROMPTFLUX queried the Gemini API roughly hourly and generated more than 70 obfuscated variants in under four hours, and that AI-assisted whole-block code replacement approaches metamorphic behavior, leaving no stable core to fingerprint. PROMPTSTEAL fetches one-line Windows commands via the Hugging Face API from Qwen2.5-Coder-32B-Instruct to collect files and system information; Google linked its live LLM use to APT28 activity targeting Ukraine. Morphisec additionally noted that PROMPTSTEAL, PromptLock, and BlackMamba all use LLMs for command generation and payload mutation. On defenses, the sources agree on recommending behavioral detection and prevention-first execution controls (patching, scripting restrictions) but disagree on framing: the GBHackers report says signature-based defenses retain value, while Morphisec argues signature-based controls lose value when every copy of the malware differs.

• PROMPTFLUX is an experimental VBScript dropper that calls the Gemini API to regenerate and obfuscate its own source code (Google Threat Intelligence Group).
• PROMPTFLUX writes regenerated code to the Windows Startup folder, coupling evasion with persistence.
• Per Morphisec, PROMPTFLUX queried the Gemini API roughly hourly, producing 70+ obfuscated variants in under four hours.
• Morphisec says AI-assisted whole-block code replacement approaches metamorphic behavior, leaving no stable core to fingerprint.
• PROMPTSTEAL obtains one-line Windows commands from Qwen2.5-Coder-32B-Instruct via the Hugging Face API to collect files and system information.
• Google linked PROMPTSTEAL's live LLM use to APT28 activity targeting Ukraine.
• Related samples PROMPTSTEAL, PromptLock, and BlackMamba also use LLMs for command generation and payload mutation (per Morphisec).
• Sources disagree on signature-based detection: GBHackers says signature-based defenses retain value; Morphisec says they lose value when every copy of the malware differs.