Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis

Key Takeaways

• Russia-aligned threat actors are employing a new technique, dubbed “GuardBreaker,” to bypass AI-powered malware analysis.
• GuardBreaker uses prompt injection within seemingly innocuous code comments to trick AI models into refusing to analyze malicious files.
• The UAC-0099 group, known for deploying the MATCHBOIL loader, has been observed using this method in attacks against Ukrainian targets.
• This tactic highlights a critical vulnerability in AI-assisted security tools, where an AI’s safety protocols can be weaponized against its intended function.
• Defenders must implement layered security, cross-verify AI outputs, and establish clear protocols for AI analysis failures to prevent blind spots.

Russian-aligned cyber threat actors have developed an innovative evasion technique, named GuardBreaker, designed to circumvent artificial intelligence systems used for malware analysis. This method involves embedding carefully crafted, safety-sensitive requests within standard code comments, prompting AI code scanners to halt their analysis prematurely.

This activity was identified during an initial infiltration attempt targeting an entity in Ukraine. The malicious VBScript was engineered to download and install MATCHBOIL, a loader exclusively linked to the UAC-0099 threat group. MATCHBOIL is typically used to deliver additional payloads onto compromised systems.

Security researchers at Welivesecurity, ESET’s research publication, discovered this novel tactic within a UAC-0099 script. The specific comment found within the code sought instructions on constructing a nuclear weapon. This content was intentionally formulated to trigger the AI model’s built-in safety mechanisms and prevent further processing, as ESET said in a report.

The significance of this discovery is amplified by the increasing reliance on AI for sorting suspicious files and supporting malware investigations. If attackers can compel an AI scanner to abandon a file before it reaches the core malicious instructions, security teams could face significant delays or mistakenly classify a dangerous sample as benign, according to ESET’s analysis.

Russia-Aligned Hackers Use GuardBreaker Prompt Injection

GuardBreaker does not alter the functional behavior of the VBScript when executed by a victim. Instead, the malicious text is strategically placed where either a human analyst or an automated AI tool would read it, thereby turning the analysis process itself into the target of the attack.

This technique represents a form of prompt injection, where untrusted content within a file is fed to a large language model (LLM) during its analysis. The model struggles to differentiate this injected content from legitimate instructions, especially when its inherent guardrails are designed to prevent responses related to hazardous or prohibited topics.

In this particular instance, UAC-0099 appears to have integrated defenses against AI-assisted security alongside more conventional checks for analysis tools like IDA and Wireshark. The group has historically utilized phishing campaigns and the MATCHBOIL loader, making this comment-based evasion tactic a notable advancement in their operational playbook.

The simplicity of this approach belies its profound potential impact. An AI scanner that yields no result, or terminates its analysis with a safety refusal, can create a critical blind spot. If security workflows interpret a missing assessment as an indication of harmlessness rather than a flag for deeper investigation, dangerous malware could slip through defenses.

Such attacks exploit a fundamental vulnerability in AI systems: the challenge of clearly separating attacker-supplied data from legitimate analysis instructions. This boundary often becomes blurred when comments appear innocuous and remain inert during code execution.

The implications extend to software supply chains, where malicious packages have been found to contain policy-triggering text or repetitive language designed to overload an AI model’s context window, effectively concealing malicious payloads.

Why Defenders Must Verify AI Results

This incident underscores that AI models should not be the sole arbiters of code safety. Security teams must meticulously understand how each AI-assisted tool processes input, its position within decision-making workflows, and the protocols triggered when the tool encounters failures, refuses analysis, truncates content, or cannot complete its assessment.

Analysts should implement a multi-layered approach, cross-referencing AI findings with other analysis engines, traditional static and behavioral analysis, and human expert review. This layered defense becomes even more crucial as prompt injection risks evolve beyond malware triage, impacting broader AI-driven enterprise systems.

Organizations should regard unusual file structures, excessive or repetitive text, and any instructions seemingly directed at the reader or the AI model itself as suspicious context, rather than trustworthy guidance. A related AI summary prompt attack demonstrates how covert or redundant content can manipulate automated interpretations away from human expectations.

Furthermore, AI agents capable of invoking external tools like unpackers or deobfuscators require enhanced security measures due to the expanded attack surface these connections introduce. Implementing restricted permissions, rigorously reviewing all tool calls, and escalating incomplete analysis results can significantly reduce the risk that a manipulated AI analysis process becomes a conduit for malware delivery or execution.

For organizations without dedicated 24/7 security analysts, the core principle remains paramount: prevention must be tightly integrated with detection and response. Any suspicious file identified should be examined in conjunction with other activity across the environment, ensuring that a single AI model’s refusal is never the definitive judgment on a potential intrusion.

What You Should Do

• Implement a “human-in-the-loop” approach for AI-assisted malware analysis, requiring human review for any AI-flagged or inconclusive results.
• Establish clear protocols for AI tools that fail, refuse analysis, or provide truncated output, ensuring these cases are immediately escalated for manual investigation rather than dismissed.
• Utilize multiple AI models and traditional static/dynamic analysis tools in parallel to cross-verify findings and reduce reliance on a single analysis method.
• Train AI models with diverse datasets, including examples of prompt injection techniques, to improve their resilience against such evasion tactics.
• Monitor for unusual patterns in code comments, excessive repetition, or instructions embedded within non-executable sections of files, as these could indicate prompt injection attempts.
• Ensure AI agents that interact with external tools operate with the principle of least privilege, and meticulously log and review all external tool calls.
• Regularly update and patch all AI security tools and underlying infrastructure to incorporate the latest defenses against emerging evasion techniques like GuardBreaker.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.