TLDR: Google’s Threat Intelligence Group (GTIG) has identified five new AI-powered malware families – FRUITSHELL, PROMPTFLUX, PROMPTLOCK, PROMPTSTEAL, and QUIETVAULT – marking a significant shift in cybercrime. These malware strains leverage large language models (LLMs) to dynamically generate malicious code, obfuscate their behavior, and adapt in real-time, making them more challenging to detect than traditional malware. While some early experimental versions, like PROMPTFLUX, were quickly neutralized by Google, the overall trend indicates a new, more autonomous phase of AI abuse by state-sponsored and criminal groups.
Google’s Threat Intelligence Group (GTIG) has issued a significant warning, revealing the emergence of five novel AI-powered malware families that represent a new operational phase in cyber threats. Unlike previous instances where AI was primarily used for productivity or enhancing phishing lures, these new strains integrate artificial intelligence directly into their execution, allowing for dynamic self-modification and evasion of traditional defenses. This development marks a critical shift where adversaries are deploying AI-enabled malware in active operations, rather than merely using AI for support functions.
The five identified malware families are FRUITSHELL, PROMPTFLUX, PROMPTLOCK, PROMPTSTEAL, and QUIETVAULT. These tools exhibit “just-in-time” AI capabilities, leveraging large language models (LLMs) to generate malicious scripts, obfuscate their own code, and create functions on demand. This dynamic nature allows them to adapt their behavior mid-execution, posing a greater challenge for detection and defense.
Among the discovered threats, PROMPTFLUX is an experimental dropper written in VBScript that interacts with Google’s Gemini API to rewrite its own source code hourly. This self-modification is designed for obfuscation and evasion, establishing persistence by saving new versions in the Startup folder and attempting to spread via removable drives and network shares. While an early version of PROMPTFLUX was identified and its access to the Gemini API disabled by Google, the concept highlights a concerning trend.
PROMPTSTEAL, a Python-based data miner, has been observed in active operations. It utilizes the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM, generating one-line Windows commands to collect system information and documents before exfiltrating the data to adversary-controlled servers. Google noted that the Russia-linked APT28 threat group has been observed deploying PROMPTSTEAL in Ukraine, marking the first instance of malware querying an LLM in the wild.
PROMPTLOCK is an experimental, cross-platform ransomware written in Go. It dynamically generates and executes malicious Lua scripts via an LLM to perform filesystem reconnaissance, data exfiltration, and file encryption on both Windows and Linux systems.
FRUITSHELL is a publicly available PowerShell reverse shell that establishes remote command-and-control (C2) access. Notably, it includes hard-coded prompts designed to bypass detection or analysis by LLM-powered security systems and has been observed in operations.
Finally, QUIETVAULT is a JavaScript credential stealer targeting GitHub and NPM tokens. It exfiltrates captured credentials to dynamically created public GitHub repositories and leverages on-host AI command-line interface (CLI) tools and prompts to discover and exfiltrate additional secrets. This malware has also been observed in active operations.
Also Read:
- Google Cloud’s 2026 Cybersecurity Forecast: A Looming Surge in AI-Powered Cyberattacks and Global Extortion
- AI Leaders Intensify Battle Against Rising Cyber Threats, Focusing on Prompt Injection Vulnerabilities
Google’s report, “GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools,” underscores that while many of these implementations are still nascent or experimental, they provide a clear indication of how threats are evolving. Threat actors, including state-sponsored groups like Iran’s MuddyCoast (UNC3313) and APT42, China’s APT41, and North Korea’s Masan (UNC1069), have been observed misusing LLMs for various malicious activities, from malware development and debugging to phishing and data analysis. This shift signals a future where attackers will increasingly combine AI reasoning and automation to outpace traditional cybersecurity defenses.
