Findings/malware-queries-llms-in-operations

Malware that queries a language model during execution to generate commands has been used in live operations, including by a state-backed group; self-rewriting variants have been seen only in testing.

Corroboratedobserved2 evidence records from 2 independent sourcesassistant-drafted

Scope: what this does not show

GTIG marks two of the five AI-enabled malware families in its 2025 overview as experimental, including the self-rewriting PROMPTFLUX, and other publicized cases, such as ESET’s PromptLock, were proofs of concept. The evidence does not show that runtime model use makes malware more effective or harder to detect in practice.

Corroborated: Supported by at least two independent sources.

Evidence

Nov 5, 2025

Google reports malware that queries LLMs during execution, including APT28's PROMPTSTEAL

Google Threat Intelligence Group

GTIG attributes PROMPTSTEAL, which queries a hosted model for commands, to APT28 in operations against Ukraine.

Sep 22, 2026

ThreatDown finds Carbonato, a Docker botnet that installs an AI agent to run operators’ tasks

ThreatDown

A criminal botnet installs an agent framework that interprets operators’ tasks and writes the commands it runs on compromised hosts; scripts, not the agent, spread it.

How it relates to other findings

supportsqualifiescontestssupersedes

ReportedCorroboratedQualifiedContestedSupersededRevalidate· node size = evidence records · columns group by topic

Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.

This finding supersedes AI providers’ early reports found threat actors using LLMs mainly as productivity tools for research, scripting help and content, without novel attack capabilities.GTIG’s November 2025 update reports novel, model-using malware in operations, replacing its January 2025 finding of productivity-only use.

Key questions that rely on this finding

How are attackers using AI agents in real operations?Increasingly to run parts of intrusions: providers and vendors report agent-driven espionage, extortion and credential theft, and malware that queries LLMs.

Status history

2025-11-05ReportedGTIG reports malware families that use LLMs during execution, some observed in operations. · record
2026-09-22CorroboratedThreatDown independently documents a botnet whose implant is an agent framework driven by a model. · record

What would change this: Measurements comparing the detection and impact of LLM-querying malware with conventional malware, or further attributed operational cases.
Evidence kind: observed: Seen in a real incident or operation.
Freshness: Evidence 4d old · recheck in 361 daysNewest evidence Sep 22, 2026. Half-life 365 days.
Methods tested: Malware that queries an LLM at runtime
Topics: AI malware Threat intelligence

Cite this record

Fide AI. "Malware that queries a language model during execution to generate commands has been used in live operations, including by a state-backed group; self-rewriting variants have been seen only in testing.." Agentic Cyber Explorer, record malware-queries-llms-in-operations. https://agentic-cyber-explorer.pages.dev/findings/malware-queries-llms-in-operations/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-malware-queries-llms-in-operations,
  author = {{Fide AI}},
  title = {Malware that queries a language model during execution to generate commands has been used in live operations, including by a state-backed group; self-rewriting variants have been seen only in testing.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/malware-queries-llms-in-operations/},
  note = {Record malware-queries-llms-in-operations; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.