Loading story…
ESET reported that the UAC-0099 threat group used GuardBreaker, an AI-focused anti-analysis technique, against a Ukrainian organization. A malicious prompt embedded in a VBS code comment attempts to trigger an LLM's safety controls before it evaluates the malware; the script then downloads the C# MATCHBOIL loader for follow-on payload delivery. The technique targets analysis pipelines that submit untrusted file contents to an LLM without separating code and embedded data from instructions.
Related reporting describes earlier malware samples, including a partially developed sample dubbed Skynet, that embedded prompts directing AI tools to ignore previous instructions and report “NO MALWARE DETECTED.” The samples also used obfuscation, sandbox and debugger evasion, data collection, Tor functionality, and artifact cleanup. Testing cited in the reporting found OpenAI o3 and GPT-4.1 resisted the observed injection, but defenders should treat LLM findings as triage only and validate them with signature-based detection, behavioral analysis, and manual reverse engineering.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Similar prompt injections, including fake biological- and nuclear-weapons instructions, were observed in Python packages associated with the Shai-Hulud, Miasma, and Hades attacks. The content was designed to interfere with AI scanners that pass untrusted file contents directly to LLMs.
A partially developed malware sample internally named Skynet was uploaded to VirusTotal in early June 2025. It embedded an instruction intended to make AI-assisted code-analysis systems respond "NO MALWARE DETECTED," and was characterized as an early public example of malware using prompt injection to evade AI analysis.
ESET identified GuardBreaker in a VBS script used by UAC-0099 during an attack on a Ukrainian organization. The script concealed a nuclear-weapons-related prompt injection in a comment and downloaded the C# MATCHBOIL loader for subsequent payload delivery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET identified **GuardBreaker**, a prompt-injection anti-analysis technique deployed by Russia-aligned UAC-0099 against a Ukrainian target. The group embedded a VBScript comment asking for instructions to build a nuclear weapon, apparently intended to make an LLM-based code scanner issue a safety refusal before analyzing the malicious portions of the file. The VBScript was designed to download and install **MATCHBOIL**, UAC-0099’s loader for delivery of further payloads. The activity demonstrates that AI-assisted malware-analysis workflows can be manipulated through untrusted code content; organizations should use layered detection and validation controls, explicitly handle model refusals or incomplete analysis, and retain human review for suspicious files.
Sep 11, 2026
Malware developers are actively experimenting with artificial intelligence, specifically large language models (LLMs), to create adaptive malware capable of rewriting its own code during execution. Google Threat Intelligence Group has identified malware families such as PromptFlux and PromptSteal that utilize LLMs to dynamically generate, modify, and execute scripts, allowing these threats to evade traditional detection methods. PromptFlux uses Gemini's API to regularly mutate its VBScript payloads, issuing prompts like "Act as an expert VBScript obfuscator" to the model, resulting in self-modifying malware that continually alters its digital fingerprints. PromptSteal, meanwhile, masquerades as an image generator but leverages a hosted LLM to generate and execute one-line Windows commands for data theft and exfiltration, effectively functioning as a live command engine. These AI-driven malware samples are still considered experimental, with limited reliability and persistence compared to traditional threats, but they represent a significant evolution in attack techniques. Notably, PromptSteal was reportedly used by Russia-linked APT28 (also known as BlueDelta, Fancy Bear, and FROZENLAKE) against Ukrainian targets, marking the first observed use of LLMs in live malware operations. The emergence of purpose-built AI tools for cybercrime is lowering the barrier for less sophisticated actors, and researchers warn that the integration of AI into malware development could soon lead to more autonomous, adaptive, and harder-to-detect threats. Google has taken steps to disrupt these operations, but the trend signals a shift toward more unpredictable and rapidly evolving attack patterns.
Jun 29, 2026
Multiple reports describe **social-engineering and supply-chain style attacks** that trick developers or AI-agent users into executing attacker-controlled instructions. North Korean operators have been linked to the **“Contagious Interview”** campaign, in which fake recruiter personas lure software developers into running “technical interview” projects that deploy malware such as **BeaverTail** and **OtterCookie** for credential theft and remote access; GitLab reported banning **131 related accounts** in 2025, with many repos using **hidden loaders** that fetched payloads from third-party services (e.g., *Vercel*) rather than hosting malware directly. Separately, OpenGuardrails reported a campaign on *ClawHub* (an OpenClaw AI agent “skills” repository) where attackers posted **malicious troubleshooting comments** containing Base64-encoded commands that download a loader from `91[.]92[.]242[.]30`, remove macOS quarantine attributes, and install **Atomic macOS (AMOS) infostealer**—a delivery method that can evade package-focused scanning because the payload is in comments, not the skill artifact. Research and incident writeups also highlight how **indirect prompt injection** and **malicious open-source packages** can compromise developer environments. NSFOCUS summarized a GitHub **MCP cross-repository data leak** scenario where attacker-injected instructions in public Issues could cause locally running AI agents to exfiltrate private repo data when agents act with broad GitHub permissions, and cited a similar hidden-command issue affecting an AI browser’s page summarization workflow. JFrog reported malicious npm packages (e.g., `eslint-verify-plugin`, `duer-js`) delivering multi-stage payloads including a **macOS RAT** (Mythic/Apfell) and a Windows infostealer, reinforcing ongoing risk from poisoned dependencies. In contrast, a DFIR case study on **CVE-2023-46604** exploitation of Apache ActiveMQ leading to **LockBit**-style ransomware, and a Medium post on recon/content-discovery techniques, are separate topics and not part of the AI-agent/developer social-engineering thread.
Jun 29, 2026