# AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)

> Google's Threat Intelligence Group (GTIG) documented the first malware families that query large language models during live execution rather than at development time: PROMPTFLUX, an experimental VBScript dropper that calls the Gemini API hourly to rewrite and re-obfuscate its own source code, and PROMPTSTEAL (CERT-UA designation: LAMEHUG), a Python data miner tied to Russian state actor APT28 that queries the Hugging Face-hosted Qwen2.5-Coder-32B-Instruct model to generate one-line Windows reconnaissance and exfiltration commands on demand. LAMEHUG was used in a July 2025 phishing campaign against Ukrainian government/defense officials.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2559
- **ID:** TL-2026-2559
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In a report published November 5, 2025 ('Advances in Threat Actor Usage of AI Tools'), GTIG disclosed that it had for the first time observed malware embedding LLM queries directly into its execution logic, rather than using AI only as a development aid.

PROMPTFLUX is an experimental VBScript dropper first observed by GTIG in June 2025. Its core innovation is a component GTIG calls the 'Thinking Robot' (evolved in later samples into a function named 'Thinging'): it sends a hard-coded API key to the Gemini API (model 'gemini-1.5-flash-latest', chosen with the '-latest' alias specifically for resilience against model deprecation) with a machine-parsable prompt instructing Gemini to act as an 'expert VBScript obfuscator' and return only executable code, no markdown. The returned code is logged to %TEMP%\thinking_robot_log.txt and written to the Windows Startup folder, combining runtime polymorphism with persistence. The 'Thinging' variant queries Gemini roughly once per hour to regenerate its entire source, and Morphisec researchers documented samples producing more than 70 distinct variants within a four-hour window -- a mutation rate that renders hash-based detection lists obsolete essentially as fast as they can be built. PROMPTFLUX also copies itself to removable drives and mapped network shares. A commented-out 'AttemptToUpdateSelf' function indicates the author intends true self-modification once complete. GTIG assesses PROMPTFLUX remains in a development/testing phase with no demonstrated ability to compromise a victim network, and attributes it only to an unidentified, likely financially motivated actor based on decoy filenames (e.g. 'crypted_ScreenRec_webinstall').

PROMPTSTEAL -- publicly disclosed first by Ukraine's CERT-UA on July 10, 2025 under the name LAMEHUG (CERT-UA alert #16039) -- is a PyInstaller-compiled Python data miner that GTIG separately attributes to APT28 (FROZENLAKE) and calls 'the first known instance of malware... querying an LLM' in a live operation. It contains no hard-coded collection commands; instead, masquerading as an 'image generation' program, it sends natural-language prompts in the background to the Hugging Face Inference API to invoke Alibaba Cloud's Qwen2.5-Coder-32B-Instruct model (using an estimated ~284 leaked/compromised Hugging Face API tokens), which returns one-line Windows shell commands. Observed prompts request: (1) creation of C:\ProgramData\info and collection of hardware, process, service, network, and Active Directory domain information into info.txt, and (2) recursive copying of Office/PDF/TXT documents from the user's Documents, Downloads, and Desktop folders into the same staging directory. Captured data is exfiltrated via SFTP or HTTP POST to attacker infrastructure. CERT-UA's initial campaign delivered LAMEHUG via phishing emails impersonating Ukrainian ministry officials, sent from a compromised mailbox (boroda70@meta.ua) partly through a VPN exit node (192.36.27.37), containing a ZIP archive ('Додаток.pdf.zip') with a PIF loader, a PDF decoy, and AI-themed lure executables ('AI_generator_uncensored_Canvas_PRO_v0.9.exe', 'AI_image_generator_v0.95.exe') plus a Python component (image.py). One observed variant exfiltrated over SSH to 144.126.202.227; another POSTed to https://stayathomeclasses.com/slpw/up.php. CERT-UA attributes the campaign to APT28/UAC-0001 with medium confidence and notes the malware was under active, iterative development (new obfuscation layers, evolving C2 methods) rather than a single static build.

Both families were disclosed in the same GTIG report alongside three other AI-abusing malware families GTIG identified in 2025 -- FRUITSHELL (PowerShell reverse shell with hard-coded prompts designed to bypass LLM-based security classifiers), PROMPTLOCK (experimental Go/Lua cross-platform ransomware PoC that generates encryption scripts via a local LLM), and QUIETVAULT (JavaScript GitHub/NPM token stealer that uses on-host AI CLI tools to hunt for additional secrets). Google states it disabled the Gemini projects/accounts and Hugging Face-linked infrastructure associated with the identified PROMPTFLUX and PROMPTSTEAL activity, and strengthened Gemini's classifiers and model-level safeguards to refuse this class of prompt.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1091 Replication Through Removable Media
- T1082 System Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1560.001 Archive via Utility
- T1074.001 Local Data Staging
- T1102.002 Bidirectional Communication
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography

## Sources

- [AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection](https://gbhackers.com/ai-powered-malware/)
- [Malware That Rewrites Itself Every Hour: AI-Powered Polymorphic Threats Break Signature-Based Defense](https://www.morphisec.com/blog/malware-that-rewrites-itself-every-hour-ai-powered-polymorphic-threats-break-signature-based-defense/)
- [Advances in Threat Actor Usage of AI Tools (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools)
- [Advances in Threat Actor Usage of AI Tools (full PDF report)](https://services.google.com/fh/files/misc/advances-in-threat-actor-usage-of-ai-tools-en.pdf)
- [Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code Hourly](https://thehackernews.com/2025/11/google-uncovers-promptflux-malware-that.html)
- [CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign](https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html)
- [CERT-UA Advisory #16039 -- LAMEHUG](https://cert.gov.ua/article/6284730)
- [MITRE ATT&CK: LAMEHUG (S9035)](https://attack.mitre.org/software/S9035/)
- [Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware](https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2559