AI Malware Evades Detection by Rewriting Itself Hourly

Key Takeaways

• AI-powered malware is evolving to rewrite its code hourly, rendering traditional signature-based detection methods ineffective.
• The PROMPTFLUX dropper, identified by Google researchers, used the Gemini API to generate over 70 obfuscated variants in under four hours.
• This new generation of polymorphic threats, including PROMPTSTEAL, PromptLock, and BlackMamba, can automate code generation and payload alteration.
• The primary concern is the significant challenge this poses to signature-based security controls and the increased speed of malware evolution.
• Defenders must shift to a prevention-first strategy focusing on blocking execution conditions and monitoring behavioral anomalies rather than relying solely on file signatures.

AI-Powered Malware Rewrites Itself Hourly, Bypassing Signature-Based Detection

The cybersecurity landscape is facing a significant escalation in threat sophistication with the emergence of AI-powered malware capable of hourly self-rewriting. This new class of malicious software continually alters its code, presenting a formidable challenge to conventional antivirus solutions that rely on identifying fixed code patterns or signatures.

This advanced polymorphic capability stems from the integration of large language models (LLMs) as automated code generation engines. A malicious dropper can leverage these LLMs to request a newly obfuscated version of itself at frequent intervals. Concurrently, associated tools can generate succinct commands for data exfiltration, such as collecting sensitive documents.

This innovation dramatically reduces the need for specialized coding expertise and the time traditionally required to produce novel malware samples. Morphisec analysts highlighted this concerning trend after examining reports on PROMPTFLUX, an experimental dropper first disclosed by Google’s threat researchers in late 2025.

The PROMPTFLUX sample was observed querying the Gemini API approximately once every hour to regenerate its obfuscated code. Researchers documented the creation of more than 70 distinct variants within a span of less than four hours. As Morphisec said in a report, the immediate concern isn’t widespread campaigns, but the immense pressure this places on signature-driven security mechanisms.

The Challenge to Traditional Defenses

Static file hashes and established malware patterns lose their efficacy when every instance of a malicious program differs. The threat is further amplified when this self-modifying code operates primarily in memory, an approach detailed in resources on fileless malware, leaving minimal forensic traces.

While traditional polymorphic malware typically encrypts or disguises its payload while maintaining some core logic, AI-assisted variants push this further. They can entirely replace code blocks, exhibiting behavior closer to metamorphic malware. This makes it incredibly difficult for defenders to establish a consistent “fingerprint” across different samples for detection.

PROMPTFLUX serves as a stark illustration, but it is part of a broader pattern of AI-enhanced threats. Other examples include PROMPTSTEAL, which utilizes language models to craft single-line Windows commands for document collection, and PromptLock and BlackMamba, both reported to employ LLMs for dynamic payload modification during execution. Prior reports on AI-driven malware evading security tools underscore the growing concern surrounding these capabilities.

For security teams, the critical issue is the speed of mutation. Detection rules are typically developed after analysts identify a specific suspicious file, command, or behavior. If the malware morphs before such a rule can be deployed to endpoints, the rule may only detect older versions, leaving newer iterations unaddressed and capable of continued harm.

This does not render signatures obsolete; they remain crucial for identifying known threats, aiding investigations, and blocking recurring activities. However, security professionals must refrain from considering a clean scan as definitive proof of a newly delivered program’s safety, especially if it initiates scripts, leverages built-in system tools, or operates predominantly in memory.

What You Should Do

• Embrace a Prevention-First Strategy: Focus on blocking the conditions that allow malicious code to execute, rather than solely on identifying specific malware strains. This includes hardening system configurations and restricting unauthorized process behaviors.
• Implement Advanced Endpoint Protection: Deploy endpoint detection and response (EDR) solutions that offer behavioral analysis, memory protection, and exploit prevention capabilities beyond traditional signature-based antivirus.
• Regularly Patch and Update: Ensure all operating systems, applications, and internet-facing services are kept up-to-date with the latest security patches to close known vulnerabilities.
• Restrict Unnecessary Privileges and Tools: Limit the use of scripting engines (e.g., PowerShell) and administrative utilities to essential functions and personnel. Investigate any unusual child processes or commands accessing sensitive data.
• Monitor for Behavioral Anomalies: Shift focus from static indicators to dynamic behaviors. Look for suspicious credential access attempts, unexpected archive creation, unusual outbound network connections, or the abnormal use of legitimate system tools.
• Enhance Incident Response Planning: Conduct routine tabletop exercises that simulate scenarios where the initial malware sample disappears or changes rapidly. This will help responders prioritize containment, evidence collection (especially endpoint telemetry), and recovery efforts over a lengthy identification process.
• Review Runtime Environment Controls: Explore solutions that can modify the runtime memory environment at process launch or present decoy resources to an attacker, potentially disrupting payloads before they can encrypt data or spread.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.