AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
AI-Powered Polymorphic Malware Queries LLMs at Runtime to (TL-2026-2559), also tracked as LAMEHUG, is a medium-severity malware campaign, first published 2026-09-18. It is attributed to APT28 (Russia) with medium confidence, affects Google Gemini API (model gemini-1.5-flash-latest), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-2559
- Threat ID
- TL-2026-2559
- Also known as
- LAMEHUG
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-18
- Last reviewed
- 2026-09-18
- Attribution
- APT28
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense
- Target regions
- ukraine, Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in AI-Powered Polymorphic Malware Queries LLMs at Runtime to
Malware and tooling: LAMEHUG, LAMEHUG - S9035, PROMPTFLUX, Qwen2.5-Coder-32B-Instruct, SOURFACE
Google's Threat Intelligence Group (GTIG) documented the first malware families that query large language models during live execution rather than at development time: PROMPTFLUX, an experimental VBScript dropper that calls the Gemini API hourly to rewrite and re-obfuscate its own source code, and PROMPTSTEAL (CERT-UA designation: LAMEHUG), a Python data miner tied to Russian state actor APT28 that queries the Hugging Face-hosted Qwen2.5-Coder-32B-Instruct model to generate one-line Windows reconnaissance and exfiltration commands on demand. LAMEHUG was used in a July 2025 phishing campaign against Ukrainian government/defense officials.
How AI-Powered Polymorphic Malware Queries LLMs at Runtime to works
In a report published November 5, 2025 ('Advances in Threat Actor Usage of AI Tools'), GTIG disclosed that it had for the first time observed malware embedding LLM queries directly into its execution logic, rather than using AI only as a development aid.
PROMPTFLUX is an experimental VBScript dropper first observed by GTIG in June 2025. Its core innovation is a component GTIG calls the 'Thinking Robot' (evolved in later samples into a function named 'Thinging'): it sends a hard-coded API key to the Gemini API (model 'gemini-1.5-flash-latest', chosen with the '-latest' alias specifically for resilience against model deprecation) with a machine-parsable prompt instructing Gemini to act as an 'expert VBScript obfuscator' and return only executable code, no markdown. The returned code is logged to %TEMP% hinking_robot_log.txt and written to the Windows Startup folder, combining runtime polymorphism with persistence. The 'Thinging' variant queries Gemini roughly once per hour to regenerate its entire source, and Morphisec researchers documented samples producing more than 70 distinct variants within a four-hour window -- a mutation rate that renders hash-based detection lists obsolete essentially as fast as they can be built. PROMPTFLUX also copies itself to removable drives and mapped network shares. A commented-out 'AttemptToUpdateSelf' function indicates the author intends true self-modification once complete. GTIG assesses PROMPTFLUX remains in a development/testing phase with no demonstrated ability to compromise a victim network, and attributes it only to an unidentified, likely financially motivated actor based on decoy filenames (e.g. 'crypted_ScreenRec_webinstall').
PROMPTSTEAL -- publicly disclosed first by Ukraine's CERT-UA on July 10, 2025 under the name LAMEHUG (CERT-UA alert #16039) -- is a PyInstaller-compiled Python data miner that GTIG separately attributes to APT28 (FROZENLAKE) and calls 'the first known instance of malware... querying an LLM' in a live operation. It contains no hard-coded collection commands; instead, masquerading as an 'image generation' program, it sends natural-language prompts in the background to the Hugging Face Inference API to invoke Alibaba Cloud's Qwen2.5-Coder-32B-Instruct model (using an estimated ~284 leaked/compromised Hugging Face API tokens), which returns one-line Windows shell commands. Observed prompts request: (1) creation of C:\ProgramData\info and collection of hardware, process, service, network, and Active Directory domain information into info.txt, and (2) recursive copying of Office/PDF/TXT documents from the user's Documents, Downloads, and Desktop folders into the same staging directory. Captured data is exfiltrated via SFTP or HTTP POST to attacker infrastructure. CERT-UA's initial campaign delivered LAMEHUG via phishing emails impersonating Ukrainian ministry officials, sent from a compromised mailbox (boroda70@meta.ua) partly through a VPN exit node (192.36.27.37), containing a ZIP archive ('Додаток.pdf.zip') with a PIF loader, a PDF decoy, and AI-themed lure executables ('AI_generator_uncensored_Canvas_PRO_v0.9.exe', 'AI_image_generator_v0.95.exe') plus a Python component (image.py). One observed variant exfiltrated over SSH to 144.126.202.227; another POSTed to https://stayathomeclasses.com/slpw/up.php. CERT-UA attributes the campaign to APT28/UAC-0001 with medium confidence and notes the malware was under active, iterative development (new obfuscation layers, evolving C2 methods) rather than a single static build.
Both families were disclosed in the same GTIG report alongside three other AI-abusing malware families GTIG identified in 2025 -- FRUITSHELL (PowerShell reverse shell with hard-coded prompts designed to bypass LLM-based security classifiers), PROMPTLOCK (experimental Go/Lua cross-platform ransomware PoC that generates encryption scripts via a local LLM), and QUIETVAULT (JavaScript GitHub/NPM token stealer that uses on-host AI CLI tools to hunt for additional secrets). Google states it disabled the Gemini projects/accounts and Hugging Face-linked infrastructure associated with the identified PROMPTFLUX and PROMPTSTEAL activity, and strengthened Gemini's classifiers and model-level safeguards to refuse this class of prompt.
MITRE ATT&CK techniques used in TL-2026-2559
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1119 Automated Collection; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography
Discovery
T1082 System Information Discovery
Lateral Movement
T1091 Replication Through Removable Media
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
Affected products and versions in AI-Powered Polymorphic Malware Queries LLMs at Runtime to
- Google — Gemini API (model gemini-1.5-flash-latest)
Vulnerable versions: Abused as an external code-generation oracle by PROMPTFLUX's 'Thinking Robot'/'Thinging' component via a hard-coded API key
Fixed in: Google disabled the associated projects/accounts and strengthened Gemini classifiers/model-level safeguards to refuse this prompt pattern (per Nov 5, 2025 GTIG report) - Hugging Face — Hosted Inference API / Qwen2.5-Coder-32B-Instruct (Alibaba Cloud model)
Vulnerable versions: Queried by PROMPTSTEAL/LAMEHUG using an estimated ~284 leaked or compromised Hugging Face API tokens to generate Windows reconnaissance/exfiltration commands on demand
Fixed in: No vendor patch applicable; Google reports disabling associated accounts it identified, token rotation/monitoring recommended for affected organizations - Microsoft — Windows (Windows Script Host / VBScript, cmd.exe, PyInstaller-compiled Python binaries)
Vulnerable versions: All Windows versions supporting WSH/VBScript execution and standalone PyInstaller executables
Fixed in: Not a vulnerability; mitigated via WSH restriction, AMSI integration, and EDR behavioral detection rather than a patch
Remediation for AI-Powered Polymorphic Malware Queries LLMs at Runtime to
Immediate actions
- Alert on and block outbound connections from unmanaged scripts/executables (cscript.exe, wscript.exe, unsigned PyInstaller binaries) to generativelanguage.googleapis.com and huggingface.co API endpoints
- Block/hunt the confirmed CERT-UA #16039 network indicators: 144.126.202.227, 192.36.27.37, stayathomeclasses.com, https://stayathomeclasses.com/slpw/up.php
- Sweep endpoints and email gateways for the six CERT-UA-confirmed LAMEHUG/PROMPTSTEAL file hashes
- Alert on creation of C:\ProgramData\info\ and %TEMP%\thinking_robot_log.txt, both used as malware staging/logging artifacts
Workarounds
- Disable Windows Script Host (wscript.exe/cscript.exe) organization-wide where VBScript execution is not a business requirement
- Restrict or proxy-inspect direct endpoint access to public LLM inference APIs from standard user workstations
- Block execution of unsigned PyInstaller-packaged binaries via application allowlisting, particularly those with AI/image-generation-themed filenames
Longer-term hardening
- Deploy EDR/AMSI behavioral rules that flag processes which make outbound LLM API calls and then execute the returned text as a command or script (the shared PROMPTFLUX/PROMPTSTEAL TTP)
- Instrument logging/anomaly detection for enterprise use of public LLM APIs (Gemini, Hugging Face, OpenAI) to catch malware-as-API-consumer patterns distinct from legitimate developer traffic
- Audit for exposed/leaked Hugging Face and Gemini API keys in internal repos and tooling; GTIG observed PROMPTSTEAL using an estimated 284 compromised Hugging Face tokens
- Shift static/hash-based detection toward behavioral and content-based detection for VBScript/Python droppers, since AI-driven hourly re-obfuscation defeats hash and simple-signature approaches
Timeline of AI-Powered Polymorphic Malware Queries LLMs at Runtime to
- GTIG first observes PROMPTFLUX, an experimental VBScript dropper whose 'Thinking Robot' component queries the Gemini API to obtain AV-evasion code; assessed to be in development/testing with no demonstrated compromise capability.
- CERT-UA receives reports of phishing emails impersonating Ukrainian ministry officials, sent from a compromised mailbox (boroda70@meta.ua), delivering a ZIP archive containing the LAMEHUG/PROMPTSTEAL loader, a PDF decoy, and AI-themed lure executables.
- CERT-UA publishes advisory #16039 attributing LAMEHUG to APT28/UAC-0001 with medium confidence, describing it as the first publicly documented malware to query an LLM (Hugging Face-hosted Qwen2.5-Coder-32B-Instruct) live in operations for on-demand Windows command generation.
- Later PROMPTFLUX samples replace the 'Thinking Robot' function with 'Thinging', which queries Gemini roughly hourly to regenerate the malware's entire source; Morphisec documents a sample producing over 70 distinct variants within four hours.
- Google states it disabled the Gemini projects/accounts and Hugging Face-linked infrastructure associated with the identified PROMPTFLUX and PROMPTSTEAL activity, and strengthened Gemini's classifiers and model-level safeguards against this prompt pattern.
- Google Threat Intelligence Group publishes 'Advances in Threat Actor Usage of AI Tools,' formally documenting PROMPTFLUX and PROMPTSTEAL alongside FRUITSHELL, PROMPTLOCK, and QUIETVAULT as the first cohort of malware observed querying LLMs during live execution.
- GBHackers and Morphisec publish follow-on coverage recapping GTIG's findings on AI-driven polymorphic malware, prompting this threat-intel hunt entry.
Sources cited for AI-Powered Polymorphic Malware Queries LLMs at Runtime to
- AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
- Malware That Rewrites Itself Every Hour: AI-Powered Polymorphic Threats Break Signature-Based Defense
- Advances in Threat Actor Usage of AI Tools (GTIG)
- Advances in Threat Actor Usage of AI Tools (full PDF report)
- Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly
- CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign
- CERT-UA Advisory #16039 -- LAMEHUG
- MITRE ATT&CK: LAMEHUG (S9035)
- Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware
More in malware
- MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
- EtherHiding / Blockchain Dead Drops: Nation-State Actors Drive 440% Surge in On-Chain Malware C2
- KREMLIN Banking Malware Forges Chrome/Edge Secure Preferences Integrity Checks to Force-Install Malicious 'AVSync' Extension
- Iranian State Actors Deploy CHOSEN BRICK Windows Malware to Spy on Dissidents, Activists, and Journalists
- Chosen Brick: Iranian State-Sponsored Windows Surveillance Malware Exposed by US, UK, and Dutch Agencies
Detection coverage for TL-2026-2559
As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2559 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.