Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly
On Wednesday, Google announced that it has identified an unidentified threat actor utilizing PROMPTFLUX, an experimental Visual Basic Script (VB Script) malware that communicates with its Gemini artificial intelligence (AI) model API to generate its own source code for enhanced obfuscation and evasion.
According to a report shared with The Hacker News by Google Threat Intelligence Group (GTIG), PROMPTFLUX is written in VB Script and interacts with Gemini's API to request specific VBScript obfuscation and evasion techniques to facilitate "just-in-time" self-modification, likely to evade static signature-based detection.
The innovative feature is a part of its "Thinking Robot" component, which regularly retrieves fresh code to avoid detection by querying the large language model (LLM)...