Malware That Rewrites Itself Every Hour: AI-Powered Polymorphic Threats Break Signature-Based Defense
AI-powered polymorphic malware like PROMPTFLUX rewrites itself hourly via LLM APIs, rendering signature-based AV ineffective and requiring deterministic prevention at execution. AI-powered polymorphic malware uses LLMs to autonomously rewrite its code, producing structurally unique variants that defeat signature and hash-based detection. Families like PROMPTFLUX and PROMPTSTEAL demonstrate this by querying AI APIs to generate new payloads or harvesting commands on demand. Traditional reactive detection cannot keep pace with machine-speed mutation.
Detection / Hunteropenrouter
Immediate Actions
- Block unauthorized outbound connections to public LLM APIs from endpoints
- Deploy deterministic prevention controls like AMTD to stop execution at runtime
Key Takeaways
- PROMPTFLUX queries the Gemini API hourly to regenerate obfuscated code, producing over 70 variants in under four hours.
- Unlike classic polymorphism, AI-driven metamorphic malware has no stable core payload to fingerprint.
- PROMPTSTEAL uses an LLM to generate one-line Windows commands on demand to harvest documents.
- Named families PromptLock and BlackMamba use LLMs to rewrite payloads in real time.
- Morphisec's AMTD defends by morphing runtime memory at process launch, relocating resources to decoys.
Attack Chain
- Initial Access: Malware delivered to endpoint via unspecified vector
- Execution: PROMPTFLUX queries Gemini API hourly to regenerate obfuscated code
- Defense Evasion: Malware produces 70+ structurally unique variants in under four hours
- Collection: PROMPTSTEAL generates one-line Windows commands to harvest documents
- Impact: Payload executes before signature-based detection can identify it
Affected Systems
- Windows endpoints
- Systems relying on signature-based AV
- Systems relying on behavioral AI detection
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Malware mutates its code hourly, leaving no stable hash or signature for EDR to match. |
| Network Visibility | Medium | Outbound calls to LLM APIs like Gemini may be observable but blend with legitimate traffic. |
| Detection Difficulty | Very Hard | No stable core payload to fingerprint; variants are structurally unique and generated at machine speed. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for processes making repeated outbound connections to LLM APIs and subsequently spawning child processes or modifying their own code (T1027.014, T1071.001). | Network connections, process creation, file write events | Defense Evasion | Medium — legitimate dev tools may query AI APIs |
| Hunt for processes generating numerous unique executable files or scripts in a short timeframe, indicating metamorphic code generation (T1027.014). | File creation, file hash, process execution | Defense Evasion | Low — rapid unique binary generation is rare |
Required Log Sources
- Process execution logs
- Network connection logs
- DNS resolution logs
- EDR telemetry
Key Behavioral Indicators
- Processes making repeated calls to generative AI APIs
- Rapid generation of unique executable files from a single process
- Self-modifying code or processes writing new executables at runtime
- Processes spawning one-line Windows commands for document collection
Control Gaps
- Signature-based AV cannot detect structurally unique variants
- Hash-based reputation engines defeated by constant mutation
- Behavioral AI detection may miss novel variants it has not seen
False Positive Assessment
Low — Rapid generation of unique binaries and calls to LLM APIs from processes are strong indicators of malicious activity.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict endpoint access to public AI APIs via network filtering
- Implement egress filtering to block direct calls to generative AI services
User Protection
- Ensure EDR and NGAV are supplemented with prevention-first controls
- Monitor endpoints for self-modifying binaries or rapid variant generation
Security Awareness
- Train staff on risks of AI-powered malware evading traditional detection
- Educate users on how AI tools can be abused by threat actors
MITRE ATT&CK Mapping
Plain-Language Summary
Hackers are using AI to create malware that rewrites its own code every hour, making each copy look completely different. Traditional antivirus software relies on recognizing known patterns, so it cannot catch these constantly changing threats. Organizations need to adopt prevention-first security measures that stop malware from running in the first place, rather than trying to detect it after the fact.