google

Google’s Threat Intelligence Group (GTIG) has uncovered a major shift in cybercriminal tactics. Several newly identified malware families now use large language models (LLMs) during attacks to generate or disguise malicious code. This marks the rise of “living” malware — software that rewrites itself in real time, evades detection, and targets digital assets with precision.
According to GTIG, at least five distinct strains of AI-enabled malware have been detected using external models such as Gemini and Qwen2.5-Coder to create new functions on demand. Instead of embedding malicious logic directly in the code, attackers now outsource key functionality to artificial intelligence, giving them unprecedented flexibility and adaptability.

How AI Is Transforming Malware
This new approach allows malware to:

🔹 Constantly rewrite its own code to evade antivirus systems

🔹 Generate new attack scripts dynamically during execution
In the past, malicious logic was hardcoded into binaries. Now, the malware’s behavior evolves in real time — adapting instantly to bypass defensive measures and security filters.

Attack Examples and Groups Involved
Google’s report highlights two major families: PROMPTFLUX and PROMPTSTEAL. The former contacts the Gemini API every hour to rewrite its VBScript and remain undetectable. The latter, linked to the Russian group APT28, uses the Qwen model to generate Windows commands and exfiltration scripts.
GTIG also identified the North Korean group UNC1069 (Masan), which allegedly abused Gemini to target cryptocurrency exchanges. The group’s prompts asked the model to generate multilingual phishing messages and scripts for accessing encrypted wallets — a sign of highly automated, AI-assisted attacks.

A New Phase of Cybercrime
According to Google, malware is entering a new phase where artificial intelligence can:

🔹 Locate crypto wallets on infected systems and create scripts to steal them

🔹 Generate persuasive, localized phishing emails aimed at specific victims
Attackers no longer need large development teams — a well-crafted prompt is enough to make an AI model produce working exploit code or phishing content within seconds.

Google’s Countermeasures
Google has deactivated accounts linked to these activities, strengthened API monitoring, and implemented new prompt filters to prevent malicious code generation. However, experts warn this is just the beginning of a long-term battle, as attackers could soon host their own AI models or modify prompting strategies to avoid detection.

Implications for the Crypto Industry
Google’s findings reveal that artificial intelligence has become a double-edged sword — a tool for both defense and offense. The fusion of LLMs and malware signals a new chapter in cybercrime, where AI can generate attacks, hide traces, and steal crypto assets faster than ever before.
Both companies and individual investors should strengthen wallet security, monitor app behavior for anomalies, and train employees to spot AI-generated phishing attempts, which are becoming increasingly realistic.


#AI , #CyberSecurity , #Google , #CryptoSecurity , #CryptoNews

Stay one step ahead – follow our profile and stay informed about everything important in the world of cryptocurrencies!
Notice:
,,The information and views presented in this article are intended solely for educational purposes and should not be taken as investment advice in any situation. The content of these pages should not be regarded as financial, investment, or any other form of advice. We caution that investing in cryptocurrencies can be risky and may lead to financial losses.“