Researchers Uncover GPT-4-Powered Mal Terminal Malware Creating Ransomware, Reverse Shell
Summary: SentinelOne's SentinelLABS researchers codenamed MalTerminal a Windows executable that uses an OpenAI GPT-4 chat completions endpoint to dynamically generate ransomware code or a reverse shell, and presented the findings at LABScon 2025. The endpoint was deprecated in early November 2023, suggesting the sample predates that date and likely makes it the earliest LLM-enabled malware found, though there is no evidence it was ever deployed in the wild.
What's compelling: Malware that writes its own malicious logic at runtime means the code your defenders inspect may not be the code that executes, and the sample's 2023 vintage shows this capability has been sitting in the wild's toolkit for years.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-30190
- Related
- Threat Advisory: Zero-day vulnerability in Microsoft diagnostic tool MSDT could lead to code execution Cyber Risks ·2022 0-day In-the-Wild Exploitation…so far Cyber Risks ·CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 14, 2022