Loading story…
Cisco Talos documented malware embedding natural-language instructions to manipulate AI-assisted security analysis, a technique it classifies as CAIRN A3: AI-Analysis Evasion. Its study examined 84 FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE samples collected from January 2025 through July 2026. Techniques progressed from misleading comments to model-specific chat-template spraying and fabricated legal or government warnings. Effectiveness varied: the strongest techniques steered analysis toward benign classifications at an approximately 35% net rate in testing, while more elaborate attempts often had little effect or increased suspicion. Conventional detection mechanisms remained unaffected.
Talos recommends detecting embedded anti-analysis instructions and treating malware contents strictly as evidence, never as authoritative instructions. Google’s threat-intelligence reporting describes complementary protections against AI misuse, including DeepMind’s automated evaluation framework for indirect prompt injection and the Secure AI Framework’s guidance on safeguards, safety evaluation, and red teaming. Google also highlighted defensive AI agents: Big Sleep, which discovered a real-world vulnerability and helped preempt exploitation of another, and the experimental Gemini-based CodeMender, designed to automatically fix critical code vulnerabilities. For security teams adopting AI analysis, the immediate priority is preserving the boundary between untrusted sample content and the instructions governing the analysis.
Get the actors, campaigns, and ATT&CK mapping behind it.
17 events from the most recent confirmed update back to the earliest known activity.
Talos first observed MANTLEMAZE on April 4, 2026, and tracked a 98-day campaign through July 11. Its plaintext AI-evasion content remained byte-identical across the observed builds despite repeated changes to VMProtect packing.
Talos withdrew its C:\Windows\<random> drop-path claim after determining that the paths came from VirusTotal submitter filenames, not observed file writes. Across the 36-sample sandbox set, no writes under C:\Windows\ were observed; the only dropped file was a benign PowerShell execution-policy test artifact.
Talos traced the AI-evasion comment's propagation from Norbert Tihanyi's January 2025 public post through structured course material into student scripts. The report supplied FRUITSHELL-specific and broader AI-decoy detection rules, cautioning that independent scripts sharing the comment should not be attributed to one malware family.
Talos tested anti-analysis strings from seven malware families against five local language models, producing 135 matched comparisons per string. The strongest techniques achieved approximately 35% net steering toward benign verdicts; direct FRUITSHELL and PLOTSAFE instructions were broadly effective, while elaborate approaches often had little effect or increased suspicion.
Talos documented VMProtect-packed MANTLEMAZE loaders combining template spraying with fabricated corporate ownership, government, certification, and legal claims. A development-path reference named the vulnerable Intel driver iqvw64e.sys, but the report did not establish exploitation of that driver by MANTLEMAZE.
Talos documented HOLLOWCLAD repeating a copyright-based refusal instruction across seven LLM chat-template formats to impersonate legitimate system instructions. The malware also used fake protector section names and intimidation messages to discourage analysis.
Talos documented PLOTSAFE generating anti-analysis comments from a template with varying benign activity descriptions. An uncalled 29-byte dummy function references the strings to prevent the Go compiler from removing them.
Talos examined 84 distinct FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE samples collected from January 2025 through July 2026. The report classified embedded instructions intended to manipulate automated analysis as CAIRN archetype A3: AI-Analysis Evasion.
During the 15 months following FRUITSHELL's original VirusTotal submission, Talos observed its identical anti-analysis comment in nine independent scripts attributable to at least four actors. One variant, ROZESHELL, combined the comment with AMSI bypass, runtime compilation, and a Rozena shellcode loader.
GTIG reported the FRUITSHELL PowerShell reverse shell as active in the wild. Its embedded comment instructs AI systems not to analyze the script and falsely describes it as a prime-number generator.
Google introduced CodeMender, an experimental AI-powered agent that uses Gemini models to automatically fix critical code vulnerabilities.
Big Sleep assisted in finding a vulnerability that threat actors were imminently preparing to use. Google stated that GTIG cut off the actors before they could exploit it.
A January 28, 2025 commit added ReverseShell_2025_01.ps1 to tihanyin's PSSW100AVB repository. Described as “The Fruit Shell for Pentesters,” it executes remotely received PowerShell commands and contains an AI-directed comment falsely describing it as a prime-number generator.
Google reported that Big Sleep found its first real-world software security vulnerability. The supplied content does not identify the affected software or date of discovery.
Google introduced Big Sleep, an AI agent developed by Google DeepMind and Google Project Zero to search for previously unknown software security vulnerabilities.
Google shared a developer toolkit covering responsible AI design, implementation of safeguards, model safety evaluation, and red teaming.
Google introduced the Secure AI Framework (SAIF) as a conceptual framework for securing AI systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceblog.talosintelligence.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcecloud.google.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malware developers are actively experimenting with artificial intelligence, specifically large language models (LLMs), to create adaptive malware capable of rewriting its own code during execution. Google Threat Intelligence Group has identified malware families such as PromptFlux and PromptSteal that utilize LLMs to dynamically generate, modify, and execute scripts, allowing these threats to evade traditional detection methods. PromptFlux uses Gemini's API to regularly mutate its VBScript payloads, issuing prompts like "Act as an expert VBScript obfuscator" to the model, resulting in self-modifying malware that continually alters its digital fingerprints. PromptSteal, meanwhile, masquerades as an image generator but leverages a hosted LLM to generate and execute one-line Windows commands for data theft and exfiltration, effectively functioning as a live command engine. These AI-driven malware samples are still considered experimental, with limited reliability and persistence compared to traditional threats, but they represent a significant evolution in attack techniques. Notably, PromptSteal was reportedly used by Russia-linked APT28 (also known as BlueDelta, Fancy Bear, and FROZENLAKE) against Ukrainian targets, marking the first observed use of LLMs in live malware operations. The emergence of purpose-built AI tools for cybercrime is lowering the barrier for less sophisticated actors, and researchers warn that the integration of AI into malware development could soon lead to more autonomous, adaptive, and harder-to-detect threats. Google has taken steps to disrupt these operations, but the trend signals a shift toward more unpredictable and rapidly evolving attack patterns.
Jun 29, 2026
ESET reported that the UAC-0099 threat group used **GuardBreaker**, an AI-focused anti-analysis technique, against a Ukrainian organization. A malicious prompt embedded in a VBS code comment attempts to trigger an LLM's safety controls before it evaluates the malware; the script then downloads the C# **MATCHBOIL** loader for follow-on payload delivery. The technique targets analysis pipelines that submit untrusted file contents to an LLM without separating code and embedded data from instructions. Related reporting describes earlier malware samples, including a partially developed sample dubbed Skynet, that embedded prompts directing AI tools to ignore previous instructions and report “NO MALWARE DETECTED.” The samples also used obfuscation, sandbox and debugger evasion, data collection, Tor functionality, and artifact cleanup. Testing cited in the reporting found OpenAI o3 and GPT-4.1 resisted the observed injection, but defenders should treat LLM findings as triage only and validate them with signature-based detection, behavioral analysis, and manual reverse engineering.
Sep 7, 2026
Cisco Talos released **CAIRN** (Cognitive Artifact Intelligence Research Network), an open-source toolkit for identifying, classifying, and tracking malware that incorporates AI or large-language-model capabilities. Rather than requiring analysts to download or execute suspected malware, CAIRN hunts for metadata-based cognitive artifacts, including embedded prompts, LLM-provider endpoints, API-key prefixes, orchestration logic, local-LLM runtime references, and AI-focused evasion strings. CAIRN combines acquisition filters, relationship graphs, a three-tier YARA classification model, and semantic clustering to link candidate samples with related infrastructure and campaigns. Talos reported that hunting of malware under active development since July 2025 showed a rapid shift from optional LLM features toward autonomous multi-model orchestration, alongside AI-specific evasion techniques appearing across independently developed malware. The company cautioned that AI-related artifacts can generate significant false positives and require reverse-engineering validation before attribution or definitive conclusions.
Sep 22, 2026