In its November 5, 2025 AI Threat Tracker, Google's Threat Intelligence Group (GTIG) reports a new operational phase of adversarial AI misuse: malware that dynamically alters its own behavior mid-execution by querying large language models at runtime, rather than merely using AI as a productivity aid during development. PROMPTFLUX is a self-modifying VBScript dropper containing a 'Thinking Robot' module that sends hardcoded POST requests to the Gemini API (gemini-1.5-flash-latest) asking an LLM acting as 'an expert VBScript obfuscator' to rewrite its own source code for antivirus evasion; a 'Thinging' variant regenerates its entire source hourly, logs responses to %TEMP% hinking_robot_log.txt, and a commented-out AttemptToUpdateSelf function signals unfinished intent toward full metamorphic self-propagation. It persists via the Startup folder and spreads to removable drives and mapped network shares; it remains experimental/R&D with no confirmed wild compromise capability, and uses decoy filenames such as crypted_ScreenRec_webinstall suggesting a financially motivated, unattributed actor. PROMPTSTEAL, publicly tracked by Ukraine's CERT-UA as LAMEHUG and attributed with moderate-to-high confidence to Russia's APT28 (FROZENLAKE/Fancy Bear), is a Python data miner that queries the Hugging Face-hosted Qwen2.5-Coder-32B-Instruct model at runtime to generate one-line Windows commands for system/hardware/AD-domain enumeration and recursive harvesting of Office/PDF/TXT documents from Documents, Downloads, and Desktop, executing the LLM's output blind before exfiltrating via SFTP or HTTP POST. LAMEHUG was first publicly disclosed by CERT-UA on 2025-07-17 after being distributed via phishing emails to Ukrainian government officials, using ZIP attachments disguised as official documents; GTIG separately confirmed PROMPTSTEAL activity against Ukraine in June 2025 with continued development adding obfuscation and new C2 methods. PROMPTLOCK is an experimental, cross-platform (Go-written) ransomware proof-of-concept that uses an LLM to dynamically generate and execute Lua scripts at runtime for filesystem reconnaissance, data exfiltration, and file encryption on both Windows and Linux. FRUITSHELL is a PowerShell reverse shell observed in actual operations that establishes a connection to a hardcoded C2 server and embeds hardcoded prompts specifically crafted to bypass LLM-powered security analysis tools. QUIETVAULT is a JavaScript credential stealer observed in operations that harvests GitHub and NPM tokens plus other on-host secrets, uses AI prompts against installed AI CLI tools to search the host for additional exposed secrets, and exfiltrates stolen data by creating a publicly accessible GitHub repository. Beyond novel malware, GTIG documents extensive misuse of Gemini itself across the full attack lifecycle by six distinct state-nexus actors. TEMP.Zagros (MuddyWater/MUDDYCOAST, Iran) used Gemini for malware development support in June 2025, adopting social-engineering pretexts against the model itself — posing as a university student on a 'final project,' a security paper author, or an 'international article' writer — to bypass safety refusals, ultimately building a custom Python-based C2 server and web shells; in a critical OPSEC failure the actor pasted a script containing its hardcoded C2 domain and encryption key directly into a Gemini prompt, which Google used to identify and disrupt the entire campaign. UNC1069 (MASAN, North Korea), active in cryptocurrency-sector intrusions since at least 2018 and pivoting from spear-phishing/traditional finance toward Web3 (exchanges, developers, VC funds) since 2023, used Gemini for cryptocurrency-victim research and reconnaissance, locating crypto-wallet application data, generating Spanish-language social-engineering pretexts (work excuses, meeting reschedules), attempting code for cryptocurrency theft, and drafting fraudulent software-update instructions; it separately built deepfake images and videos impersonating cryptocurrency executives to lure victims into fake Zoom meetings (via Calendly-scheduled calls redirecting to spoofed Zoom infrastructure) that deliver the BIGMACHO backdoor via a trojanized 'Zoom SDK,' and has deployed at least seven distinct malware families including SILENCELIFT, DEEPBREATH, and CHROMEPUSH. UNC4899 (PUKCHONG, North Korea), a group with a history of supply-chain compromises, used Gemini for code-development assistance, exploit research, and tool improvement, specifically for vulnerability research targeting edge devices and modern browsers. APT42 (Iran) used Gemini for text generation/editing in phishing campaigns impersonating think-tank figures with security-technology and geopolitical-event lures, for specialized translation, for general and Israeli-defense-focused research, and to prototype a novel 'Data Processing Agent' that converts natural-language requests into SQL queries against schemas for linking phone numbers to owners, tracking travel patterns, and generating lists of people by shared attributes. APT41 (China), in August 2025 activity, used Gemini for C++ and Golang code development, for building the OSSTUN C2 framework, and for code-obfuscation assistance, requesting help specifically with publicly available obfuscation libraries. A separate unattributed China-nexus actor used a 'capture-the-flag' pretext ('I am working on a CTF problem') between January and June 2025 to defeat an initial safety refusal and extract vulnerability-identification and exploitation techniques, which it then applied across the attack lifecycle — reconnaissance, phishing, lateral-movement research, C2 development, and data exfiltration — against Windows, AWS (EC2 token abuse), vSphere, Kubernetes (container/pod enumeration), and macOS (host permissions research) targets. GTIG also documents a maturing English- and Russian-language underground marketplace advertising AI tools for deepfake/image generation (phishing lures, KYC bypass), custom malware generation, phishing kit support, research/reconnaissance, general code generation, and vulnerability exploitation, sold via free ad-supported tiers and paid subscriptions with Discord-based delivery; nearly every advertised tool also markets phishing support. In response, Google disabled all identified accounts, projects, and associated assets; strengthened Gemini's classifiers to refuse CTF/student/researcher social-engineering pretexts; applied model-level changes refusing malware development, adversarial exploit research, evasive obfuscation, credential theft, and C2 development assistance; and referenced its Secure AI Framework (SAIF), continuous red-teaming against indirect prompt injection, and the Big Sleep and CodeMender AI agents for vulnerability discovery and auto-patching.