AI-powered malware is complicating security defenses by constantly changing its code, making it harder for antivirus tools to detect This article explores ai powered malware. . Instead of using the same code for an extended period, these programs can alter their form frequently while maintaining the same harmful intent.
Morphisec analysts observed a change following an examination of reports on PROMPTFLUX, an experimental dropper disclosed by Google's threat researchers in late 2025. The sample reportedly queried the Gemini API approximately once every hour and regenerated obfuscated code, with researchers observing over 70 variants in just four hours. Morphisec stated in a report shared with ZeroOwl (ZeroOwl) that the primary concern is not a confirmed mass campaign but the pressure this puts on signature-based controls.
However, defenders should not assume a clean scan indicates a newly delivered program is safe, especially when it executes scripts, uses built-in tools, or runs primarily in memory. Keep operating systems and internet-facing applications patched, restrict unnecessary scripting and administrative utilities, and investigate unusual child processes or commands that access large collections of documents. Analysts should focus on identifying the underlying action, such as suspicious credential access, unexpected archive creation, outbound connections, or unusual use of trusted tools, rather than relying solely on filenames or hashes.
Restrict investigation times to controlled threat intelligence platforms like MISP, VirusTotal, or your SIEM.
