Loading malware…
Promptware is a proposed malware class described in the paper “The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multi-Step Malware.” It refers to malicious inputs delivered to LLM-based applications—including text, images, audio, and other modalities—intended to exploit an application’s permissions and trigger malicious activity. The paper argues that these attacks are not merely single-step prompt injections, but increasingly resemble multi-stage malware campaigns against chatbots and autonomous agents capable of executing code, accessing data, controlling connected services, and performing financial transactions.
The proposed Promptware Kill Chain has five stages: Initial Access via direct or indirect prompt injection; Privilege Escalation via jailbreaking that bypasses model safety training and alignment; Persistence via poisoning of stateful components such as RAG databases, agent memory, or long-term memory; Lateral Movement via propagation across users, devices, connected services, messaging channels, shared data stores, or application pipelines; and Actions on Objective including data exfiltration, fraud or unauthorized transactions, physical-world effects, surveillance, credential theft, and further system compromise including remote code execution.
The supporting content states that LLMs process system prompts, user messages, and retrieved documents as a single undifferentiated token sequence, so they lack a native boundary between trusted instructions and untrusted data. As described in the paper, this makes prompt injection an inherent architectural issue rather than a bug that can be fully patched, and application-layer defenses such as filters, classifiers, prompt hardening, and safety fine-tuning can be bypassed. Reported evasion and exploitation techniques include direct and indirect prompt injection, multimodal injection through images or audio, role-play and instruction-overriding jailbreaks, obfuscation using ASCII art or Unicode tag characters, universal adversarial suffixes effective across multiple major models, and delayed tool or agent invocation.
Persistence mechanisms described in the content include retrieval-dependent payloads that execute when poisoned content is retrieved by RAG, retrieval-independent persistence through always-on long-term memory, and command-and-control-style behavior in which implanted prompts force an agent to fetch attacker-controlled instructions from external sources such as URLs or GitHub repositories. Examples cited include Morris II, a self-replicating worm targeting LLM-powered email assistants; MemoryGraft, involving RAG or experience-retrieval poisoning; a demonstrated indirect prompt injection into ChatGPT memory via a malicious Google Doc summary request; and SpAIware, which established a C2 channel against ChatGPT by implanting a memory prompt that pulled instructions from GitHub.
For lateral movement and downstream impact, the content cites attacks against Google Gemini-powered Android Assistant using a poisoned calendar invitation to trigger smart home control, Zoom surveillance, and email exfiltration via Chrome; AgentFlayer against the Cursor AI code editor through poisoned Zendesk tickets synced into Jira and later summarized through Cursor integrations, leading to credential discovery and exfiltration when auto-run is enabled; and an agentic-browser attack against Perplexity Comet in which malicious instructions in a GitHub issue caused access to a user’s Gmail session and posting of private email content back to the public issue. The content also cites an early-2025 incident involving the AiXBT AI crypto trading agent, where dashboard access was abused to queue commands that transferred about 55 ETH to an attacker-controlled wallet.
Associated names in the source material are the paper authors Ben Nassi, Bruce Schneier, and Oleg Brodt. The content frames promptware as a threat model and malware category for attacks on LLM-based systems rather than a single malware family with fixed indicators of compromise; no specific file hashes, domains, or other conventional IOCs are provided in the source.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A proposed malware class describing multi-step attacks against LLM-based systems that begin with prompt injection and can progress through jailbreaking (privilege escalation), memory/retrieval poisoning (persistence), cross-system/cross-user propagation (lateral movement), and actions on objectives such as data exfiltration or unauthorized transactions.
A class of malicious inputs (text/image/audio/etc.) designed to exploit LLM-based applications by entering the model context (prompt injection), bypassing safety controls (jailbreaking), persisting via memory/RAG poisoning, moving laterally across connected systems/users, and executing objectives such as data exfiltration, fraud, or remote code execution—leveraging the application’s permissions and integrations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.