Google warns of new AI-powered malware families deployed in the wild

Google Threat Intelligence Group details a surge in AI-powered malicious tooling and abuse of the Gemini LLM: experimental and operational malware families (PromptFlux, PromptSteal, FruitShell, QuietVault, PromptLock) leverage LLMs for dynamic code generation, evasion, credential theft, and C2; multiple nation-state and criminal groups have used Gemini for vulnerability research, phishing, malware development, and data exfiltration; underground marketplaces are increasingly offering AI-enabled attack services, and Google has taken steps to disable abused accounts and strengthen model safeguards.