Skip to navigation

Threat reportMalwareTL-2026-5218

AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL)

mediumMONITORING

HUMAN Security's VP of Threat Intelligence Lindsay Kaye describes how AI-generated malware can be recognized (tidy function comments, emojis, uniform and well-spelled logging, placeholder names such as MyWindowClass) and how AI is scaling malicious-app production from tens to hundreds. The piece also cites VoidLink (largely AI-authored, per Check Point) and PROMPTSTEAL (queries an LLM at runtime to generate commands). First disclosed .

Key facts for AI-generated malware indicators

IdentifiersTL-2026-5218
Also known asAI-generated malware, LLM-enabled malware, just-in-time AI malware
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
MalwareLAMEHUG, LAMEHUG - S9035, PROMPTFLUX, PromptLock, QUIETVAULT, VoidLink
ToolsO-MVLL, TRAE SOLO
MITRE ATT&CK techniquesT1014 Rootkit, T1027 Obfuscated Files or Information, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1059.005 Command and Scripting Interpreter: Visual Basic, T1059.006 Command and Scripting Interpreter: Python, T1071.001 Application Layer Protocol: Web Protocols, T1082 System Information Discovery, T1087.002 Account Discovery: Domain Account, T1091 Replication Through Removable Media, T1119 Automated Collection, T1204.002 User Execution: Malicious File, T1528 Steal Application Access Token and 5 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, technology, cloud, finance, advertising, mobile
Target regionsGlobal, ukraine
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for AI-generated malware indicators

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5218 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PROMPTSTEAL/LAMEHUG LLM-Generated Recon Commands Writing to C:\ProgramData\info

Detects cmd.exe/powershell.exe spawned by a Python or user-writable-path parent whose command line writes to or reads from C:\ProgramData\info, the staging folder used by PROMPTSTEAL (LAMEHUG, MITRE S9035; APT28 per Google GTIG). The malware asks an LLM (Qwen2.5-Coder-32B-Instruct via Hugging Face) for one-line Windows commands that collect system, process, service, network and AD domain information into info.txt and copy Office/PDF/TXT documents. Behaviour-first: it keys on the runtime-generated command pattern, not on code style. Part of TL-2026-5218.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1059.006, T1059.003, T1082, T1087.002, T1119
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

```comment
PROMPTSTEAL / LAMEHUG (TL-2026-5218): Python or user-path parent runs LLM-generated one-liners that write recon output under C:\ProgramData\info
```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe")
  CommandLine="*ProgramData\\info*"
  (ParentImage="*\\python.exe" OR ParentImage="*\\pythonw.exe" OR ParentImage="*\\Downloads\\*" OR ParentImage="*\\Desktop\\*" OR ParentImage="*\\AppData\\Local\\Temp\\*" OR ParentImage="*\\Users\\Public\\*")
| eval recon_cmd=case(match(CommandLine,"(?i)systeminfo"),"systeminfo", match(CommandLine,"(?i)whoami"),"whoami", match(CommandLine,"(?i)(nltest|dsquery|Get-ADUser|net\s+group\s.*/domain)"),"ad_enum", match(CommandLine,"(?i)(tasklist|Get-Process|Get-Service|sc\s+query)"),"process_service_enum", match(CommandLine,"(?i)(ipconfig|netstat|Get-NetIPAddress)"),"network_enum", match(CommandLine,"(?i)(xcopy|robocopy|copy)\s"),"doc_copy", true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen dc(recon_cmd) as distinct_stages values(recon_cmd) as stages values(CommandLine) as commands values(ParentImage) as parents by Computer, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// PROMPTSTEAL / LAMEHUG (TL-2026-5218): LLM-generated recon one-liners writing to C:\ProgramData\info
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe")
| where ProcessCommandLine contains @"ProgramData\info"
| where InitiatingProcessFileName in~ ("python.exe", "pythonw.exe")
    or InitiatingProcessFolderPath matches regex @"(?i)\\(Downloads|Desktop|Users\\Public|AppData\\Local\\Temp)\\"
| extend ReconStage = case(
    ProcessCommandLine has "systeminfo", "systeminfo",
    ProcessCommandLine has "whoami", "whoami",
    ProcessCommandLine has_any ("nltest", "dsquery", "Get-ADUser"), "ad_enum",
    ProcessCommandLine has_any ("tasklist", "Get-Process", "Get-Service"), "process_service_enum",
    ProcessCommandLine has_any ("ipconfig", "netstat", "Get-NetIPAddress"), "network_enum",
    ProcessCommandLine has_any ("xcopy", "robocopy", "copy"), "doc_copy",
    "other")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ReconStage, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath
| order by Timestamp desc

Sigma

title: PROMPTSTEAL LLM-Generated Recon Command Using ProgramData\info Staging Folder
id: 5b1e7c52-3a0d-4f6e-9c1a-2d8f40a7b101
status: experimental
description: Detects a shell spawned by a Python process or a user-writable-path parent whose command line references C:\ProgramData\info, the staging folder used by PROMPTSTEAL/LAMEHUG for LLM-generated system, process, network and AD reconnaissance output (info.txt) and copied documents.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
  - https://attack.mitre.org/software/S9035
  - https://www.helpnetsecurity.com/2026/11/04/lindsay-kaye-human-security-ai-generated-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
  - attack.execution
  - attack.t1059.006
  - attack.t1059.003
  - attack.discovery
  - attack.t1082
  - attack.t1087.002
  - attack.collection
  - attack.t1119
logsource:
  category: process_creation
  product: windows
detection:
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains: 'ProgramData\info'
  selection_parent_python:
    ParentImage|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
  condition: selection_child and selection_cli and 1 of selection_parent_*
falsepositives:
  - Legitimate administrative scripts that use a folder named info under ProgramData
  - Software inventory tools run from a Python-based deployment framework
level: high

Known false positives:

  • Administrative or inventory scripts that legitimately write to a folder named info under ProgramData
  • Python-based deployment or IT automation frameworks that run shell one-liners from a user-writable path

Tuning notes: Allow-list known IT automation parents by ParentImage hash or signer. Extend the folder match if variants rename the staging path. Pair with the staging-folder detection (SPL-002) and the non-browser LLM API detection (SPL-003) for higher fidelity.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • PROMPTFLUX VBScript Dropper - Script Host Calling Gemini API and Thinking Robot Log · unlock with TL Creds
  • Script-Based Run Key and Startup Folder Persistence (PROMPTFLUX / PROMPTSTEAL) · unlock with TL Creds
  • AI-Malware Lure Execution - [indicator], Known Sample Hashes, Mail/Archive Spawned Script Hosts · unlock with TL Creds
  • VoidLink-Style Linux Kernel Module or eBPF Program Loading From Untrusted Context · unlock with TL Creds
  • QUIETVAULT-Style GitHub/NPM Token Theft by Node.js Process Using Token Commands or AI CLI Tools · unlock with TL Creds
  • PyInstaller-Packed Python Binary Executing From User-Writable Path (PROMPTSTEAL Packaging) · unlock with TL Creds
  • PROMPTSTEAL Document Staging in C:\ProgramData\info · unlock with TL Creds
  • Non-Browser Process Resolving LLM Inference APIs (Hugging Face / Gemini) - Runtime LLM C2 · unlock with TL Creds

Indicators of compromise for AI-generated malware indicators

As of 2026-11-04, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5218.

Sample indicators (3 of 16)

  • File hash: 766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777
  • File hash: eb0687daed29f3651c61b0a2aa4a0cdcf2049a1ebae2e15e2dd9326471d318a1
  • File hash: f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

16 indicators of compromise · unlock with TL Creds. Compare plans

How AI-generated malware indicators works

This record tracks the trend of AI-generated and LLM-integrated malware, anchored on a Help Net Security interview (2026-11-04) with Lindsay Kaye, VP Threat Intelligence at HUMAN Security. It is a trend and analysis item, not a single exploited vulnerability: no CVEs were verified (identifiers from a first extraction conflicted on re-verification and are omitted), and no CISA KEV or exploitation confirmation applies.

Indicators of AI authorship cited by Kaye: in source code, structured comments describing each function (often with emojis), uniformly formatted logging messages with correct spelling and grammar, and generally 'good' design patterns. After decompilation, placeholder names such as 'MyWindowClass', consistent use of obfuscation toolkits such as O-MVLL, and a mass-produced look with shared technical commonalities across samples. Kaye reports a shift from tens to hundreds of malicious apps because generating app content is now much easier, plus faster emergence of variants. She notes she has not fully reverse engineered a fully AI-written sample herself.

Named examples. VoidLink: a Linux/cloud-focused modular malware framework disclosed by Check Point Research on 2026-01-20. Check Point assesses it was planned and written almost entirely by AI under one developer's direction using the TRAE SOLO IDE and spec-driven development. A 20-week sprint plan was documented on 2025-11-27, and 88,000+ lines of code existed by 2025-12-04. It is written in Zig, C and Go and includes cloud/container enumeration modules and eBPF and LKM rootkits. PROMPTSTEAL (CERT-UA: LAMEHUG; MITRE S9035): a PyInstaller-packaged Python data miner masquerading as an image-generation program. Google GTIG attributes it to APT28 (FROZENLAKE) in operations against Ukraine. It queries Qwen2.5-Coder-32B-Instruct via the Hugging Face API for one-line Windows commands that collect system, process, service, network and AD domain information into C:\Programdata\info\info.txt and copy Office/PDF/TXT documents from Documents, Downloads and Desktop, then exfiltrates to a server. Google's GTIG also documents PROMPTFLUX (VBScript dropper that asks Gemini to rewrite its own code for AV evasion; experimental), FRUITSHELL, PROMPTLOCK (proof-of-concept ransomware) and QUIETVAULT (JavaScript stealer for GitHub/NPM tokens).

Criminal uses cited in the interview: phishing content and mass messaging, romance/pig-butchering scam conversations, AI-written blog posts for ad fraud, generated audio for streaming fraud, structuring of stealer-exfiltrated data, automated card verification, and session hijacking with stolen cookies/tokens. The interview also mentions PHP2Shell RCE vulnerabilities as an example of AI-accelerated exploit development, which compresses patch windows; no exploitation is stated. Defender takeaway: AI authorship itself is a weak detection signal, so detection should rest on behavior (runtime LLM API calls from non-browser processes, scripted command generation, kernel-level rootkit loading, cloud-credential theft) and not on code style.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Discovery

T1082 System Information Discovery; T1087.002 Account Discovery: Domain Account

Lateral Movement

T1091 Replication Through Removable Media

Collection

T1119 Automated Collection; T1560.001 Archive Collected Data: Archive via Utility

Credential Access

T1528 Steal Application Access Token

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Initial Access

T1566.001 Phishing: Spearphishing Attachment

Resource Development

T1587.001 Develop Capabilities: Malware; T1588.007 Obtain Capabilities: Artificial Intelligence

Remediation for AI-generated malware indicators

Immediate actions

  • Hunt for non-browser processes (python.exe, PyInstaller binaries, wscript.exe/cscript.exe) connecting to LLM API endpoints such as Hugging Face or Gemini
  • Alert on creation of staging folders such as C:\Programdata\info and on bulk copies of Office/PDF/TXT files to that folder
  • Block or monitor outbound access to LLM inference APIs from servers and from endpoints with no business need

Workarounds

  • Restrict developer tokens (GitHub/NPM) and rotate any exposed to QUIETVAULT-style stealers
  • Enforce phishing-resistant MFA and short-lived sessions to limit cookie/token hijacking

Longer-term hardening

  • Do not rely on code-style indicators (comments, emojis, logging quality) for attribution or detection; build behavioral detections
  • Deploy EDR/eBPF-aware Linux runtime monitoring in cloud and container workloads to catch kernel-module and eBPF rootkit loading
  • Vet mobile apps and app SDKs for deobfuscation tells (placeholder class names, O-MVLL) and tighten app-store and ad-supply-chain controls
  • Shorten patch SLAs for internet-facing RCE vulnerabilities, since AI compresses exploit-development timelines

Timeline of AI-generated malware indicators

  • locked-ioc-12 and locked-ioc-11 first observed by Google GTIG (June 2025; day-level date not stated in sources)
  • CERT-UA documents LAMEHUG (same family as locked-ioc-11) in phishing emails targeting Ukrainian government officials (July 2025; day not stated)
  • Google GTIG publishes AI Threat Tracker describing just-in-time AI malware (locked-ioc-11, locked-ioc-12, FRUITSHELL, PROMPTLOCK, locked-ioc-13) and attributing locked-ioc-11 to APT28
  • locked-ioc-15 developer documents a 20-week sprint plan, produced with AI assistance, for the framework
  • First functional locked-ioc-15 build reaches 88,000+ lines of code; a compiled version is submitted to VirusTotal
  • Check Point Research publishes locked-ioc-15 analysis, calling it the first evidently documented advanced AI-authored malware framework
  • Help Net Security publishes interview with HUMAN Security's Lindsay Kaye on AI-generated malware indicators and trends

Sources cited for AI-generated malware indicators

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats