How Malware Authors Are Incorporating LLMs to Evade Detection

Threat actors are leveraging large language models (LLMs) and AI services to generate, rewrite, or adapt malware at runtime—examples include PROMPTFLUX, PROMPTSTEAL, FRUITSHELL, and QUIETVAULT. While many samples are experimental prototypes, three were observed in operations; capabilities include code rewriting, runtime command generation, and automated secret discovery/exfiltration. The report warns these techniques can increase evasion and adaptability but notes reliance on external AI services creates detectable signals, and recommends strong egress controls, AI-service monitoring, and ML/behavioral detection to mitigate the risk.