Analyzing the Current State of AI Use in Malware
Summary: Unit 42 researchers analyzed two malware samples found through OSINT: a .NET information stealer obfuscated with ConfuserEx 2 that calls OpenAI's GPT-3.5-Turbo API in four functions, and a dropper that sends host system data to OpenAI's GPT-4 to decide whether to deploy a Sliver payload. In the stealer, the LLM-returned evasion and obfuscation technique names were only written to log files and never implemented, while the dropper parsed the model's JSON response and launched Sliver when the execute key was true.
Key Takeaway: Unit 42 describes the stealer's LLM integration as 'AI theater' whose API calls add noise defenders are likely to notice, but the dropper's use of an LLM verdict instead of hard-coded allow and deny lists may prevent defenders from determining which process or system setting the malware authors are hiding from.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026