LameHug: The First Publicly Documented Case of a Malware Integrating a LLM

**Executive Summary:** LameHug is a Python-based infostealer attributed to APT28 that uses a cloud-hosted LLM (Alibaba Qwen via Hugging Face) to generate adaptive Windows command chains at runtime for rapid reconnaissance and exfiltration; delivered through spear-phishing ZIP/PIF attachments, it stages data to %ProgramData%\info and exfiltrates via SFTP or HTTP, representing a significant advancement in AI-assisted malware tradecraft and posing a high espionage risk to targeted government networks.