# AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL)

> HUMAN Security's VP of Threat Intelligence Lindsay Kaye describes how AI-generated malware can be recognized (tidy function comments, emojis, uniform and well-spelled logging, placeholder names such as MyWindowClass) and how AI is scaling malicious-app production from tens to hundreds. The piece also cites VoidLink (largely AI-authored, per Check Point) and PROMPTSTEAL (queries an LLM at runtime to generate commands).

- **Published:** 2026-11-04T07:22:21Z
- **Last reviewed:** 2026-11-04T07:22:21Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5218
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5218.png
- **ID:** TL-2026-5218
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

This record tracks the trend of AI-generated and LLM-integrated malware, anchored on a Help Net Security interview (2026-11-04) with Lindsay Kaye, VP Threat Intelligence at HUMAN Security. It is a trend and analysis item, not a single exploited vulnerability: no CVEs were verified (identifiers from a first extraction conflicted on re-verification and are omitted), and no CISA KEV or exploitation confirmation applies.

Indicators of AI authorship cited by Kaye: in source code, structured comments describing each function (often with emojis), uniformly formatted logging messages with correct spelling and grammar, and generally 'good' design patterns. After decompilation, placeholder names such as 'MyWindowClass', consistent use of obfuscation toolkits such as O-MVLL, and a mass-produced look with shared technical commonalities across samples. Kaye reports a shift from tens to hundreds of malicious apps because generating app content is now much easier, plus faster emergence of variants. She notes she has not fully reverse engineered a fully AI-written sample herself.

Named examples. VoidLink: a Linux/cloud-focused modular malware framework disclosed by Check Point Research on 2026-01-20. Check Point assesses it was planned and written almost entirely by AI under one developer's direction using the TRAE SOLO IDE and spec-driven development. A 20-week sprint plan was documented on 2025-11-27, and 88,000+ lines of code existed by 2025-12-04. It is written in Zig, C and Go and includes cloud/container enumeration modules and eBPF and LKM rootkits. PROMPTSTEAL (CERT-UA: LAMEHUG; MITRE S9035): a PyInstaller-packaged Python data miner masquerading as an image-generation program. Google GTIG attributes it to APT28 (FROZENLAKE) in operations against Ukraine. It queries Qwen2.5-Coder-32B-Instruct via the Hugging Face API for one-line Windows commands that collect system, process, service, network and AD domain information into C:\Programdata\info\info.txt and copy Office/PDF/TXT documents from Documents, Downloads and Desktop, then exfiltrates to a server. Google's GTIG also documents PROMPTFLUX (VBScript dropper that asks Gemini to rewrite its own code for AV evasion; experimental), FRUITSHELL, PROMPTLOCK (proof-of-concept ransomware) and QUIETVAULT (JavaScript stealer for GitHub/NPM tokens).

Criminal uses cited in the interview: phishing content and mass messaging, romance/pig-butchering scam conversations, AI-written blog posts for ad fraud, generated audio for streaming fraud, structuring of stealer-exfiltrated data, automated card verification, and session hijacking with stolen cookies/tokens. The interview also mentions PHP2Shell RCE vulnerabilities as an example of AI-accelerated exploit development, which compresses patch windows; no exploitation is stated. Defender takeaway: AI authorship itself is a weak detection signal, so detection should rest on behavior (runtime LLM API calls from non-browser processes, scripted command generation, kernel-level rootkit loading, cloud-credential theft) and not on code style.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1587.001 Develop Capabilities: Malware
- T1566.001 Phishing: Spearphishing Attachment
- T1059.006 Command and Scripting Interpreter: Python
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1204.002 User Execution: Malicious File
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1014 Rootkit
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1087.002 Account Discovery: Domain Account
- T1091 Replication Through Removable Media
- T1119 Automated Collection
- T1560.001 Archive Collected Data: Archive via Utility
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PROMPTSTEAL/LAMEHUG LLM-Generated Recon Commands Writing to C:\ProgramData\info** (`TL-2026-5218-SPL-001`)

Detects cmd.exe/powershell.exe spawned by a Python or user-writable-path parent whose command line writes to or reads from C:\ProgramData\info, the staging folder used by PROMPTSTEAL (LAMEHUG, MITRE S9035; APT28 per Google GTIG). The malware asks an LLM (Qwen2.5-Coder-32B-Instruct via Hugging Face) for one-line Windows commands that collect system, process, service, network and AD domain information into info.txt and copy Office/PDF/TXT documents. Behaviour-first: it keys on the runtime-generated command pattern, not on code style. Part of TL-2026-5218.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.006, T1059.003, T1082, T1087.002, T1119
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```comment
PROMPTSTEAL / LAMEHUG (TL-2026-5218): Python or user-path parent runs LLM-generated one-liners that write recon output under C:\ProgramData\info
```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe")
  CommandLine="*ProgramData\\info*"
  (ParentImage="*\\python.exe" OR ParentImage="*\\pythonw.exe" OR ParentImage="*\\Downloads\\*" OR ParentImage="*\\Desktop\\*" OR ParentImage="*\\AppData\\Local\\Temp\\*" OR ParentImage="*\\Users\\Public\\*")
| eval recon_cmd=case(match(CommandLine,"(?i)systeminfo"),"systeminfo", match(CommandLine,"(?i)whoami"),"whoami", match(CommandLine,"(?i)(nltest|dsquery|Get-ADUser|net\s+group\s.*/domain)"),"ad_enum", match(CommandLine,"(?i)(tasklist|Get-Process|Get-Service|sc\s+query)"),"process_service_enum", match(CommandLine,"(?i)(ipconfig|netstat|Get-NetIPAddress)"),"network_enum", match(CommandLine,"(?i)(xcopy|robocopy|copy)\s"),"doc_copy", true(),"other")
| stats count min(_time) as first_seen max(_time) as last_seen dc(recon_cmd) as distinct_stages values(recon_cmd) as stages values(CommandLine) as commands values(ParentImage) as parents by Computer, User
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
// PROMPTSTEAL / LAMEHUG (TL-2026-5218): LLM-generated recon one-liners writing to C:\ProgramData\info
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe")
| where ProcessCommandLine contains @"ProgramData\info"
| where InitiatingProcessFileName in~ ("python.exe", "pythonw.exe")
    or InitiatingProcessFolderPath matches regex @"(?i)\\(Downloads|Desktop|Users\\Public|AppData\\Local\\Temp)\\"
| extend ReconStage = case(
    ProcessCommandLine has "systeminfo", "systeminfo",
    ProcessCommandLine has "whoami", "whoami",
    ProcessCommandLine has_any ("nltest", "dsquery", "Get-ADUser"), "ad_enum",
    ProcessCommandLine has_any ("tasklist", "Get-Process", "Get-Service"), "process_service_enum",
    ProcessCommandLine has_any ("ipconfig", "netstat", "Get-NetIPAddress"), "network_enum",
    ProcessCommandLine has_any ("xcopy", "robocopy", "copy"), "doc_copy",
    "other")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ReconStage, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessFolderPath
| order by Timestamp desc
```

### Sigma

```yaml
title: PROMPTSTEAL LLM-Generated Recon Command Using ProgramData\info Staging Folder
id: 5b1e7c52-3a0d-4f6e-9c1a-2d8f40a7b101
status: experimental
description: Detects a shell spawned by a Python process or a user-writable-path parent whose command line references C:\ProgramData\info, the staging folder used by PROMPTSTEAL/LAMEHUG for LLM-generated system, process, network and AD reconnaissance output (info.txt) and copied documents.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools
  - https://attack.mitre.org/software/S9035
  - https://www.helpnetsecurity.com/2026/11/04/lindsay-kaye-human-security-ai-generated-malware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
  - attack.execution
  - attack.t1059.006
  - attack.t1059.003
  - attack.discovery
  - attack.t1082
  - attack.t1087.002
  - attack.collection
  - attack.t1119
logsource:
  category: process_creation
  product: windows
detection:
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  selection_cli:
    CommandLine|contains: 'ProgramData\info'
  selection_parent_python:
    ParentImage|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
  condition: selection_child and selection_cli and 1 of selection_parent_*
falsepositives:
  - Legitimate administrative scripts that use a folder named info under ProgramData
  - Software inventory tools run from a Python-based deployment framework
level: high

```

**Known false positives:**

- Administrative or inventory scripts that legitimately write to a folder named info under ProgramData
- Python-based deployment or IT automation frameworks that run shell one-liners from a user-writable path

**Tuning notes:** Allow-list known IT automation parents by ParentImage hash or signer. Extend the folder match if variants rename the staging path. Pair with the staging-folder detection (SPL-002) and the non-browser LLM API detection (SPL-003) for higher fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PROMPTFLUX VBScript Dropper - Script Host Calling Gemini API and Thinking Robot Log (locked: unlock with TL Creds)
- Script-Based Run Key and Startup Folder Persistence (PROMPTFLUX / PROMPTSTEAL) (locked: unlock with TL Creds)
- AI-Malware Lure Execution - [indicator], Known Sample Hashes, Mail/Archive Spawned Script Hosts (locked: unlock with TL Creds)
- VoidLink-Style Linux Kernel Module or eBPF Program Loading From Untrusted Context (locked: unlock with TL Creds)
- QUIETVAULT-Style GitHub/NPM Token Theft by Node.js Process Using Token Commands or AI CLI Tools (locked: unlock with TL Creds)
- PyInstaller-Packed Python Binary Executing From User-Writable Path (PROMPTSTEAL Packaging) (locked: unlock with TL Creds)
- PROMPTSTEAL Document Staging in C:\ProgramData\info (locked: unlock with TL Creds)
- Non-Browser Process Resolving LLM Inference APIs (Hugging Face / Gemini) - Runtime LLM C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- File hash: `766c356d6a4b00078a0293460c5967764fcd788da8c1cd1df708695f3a15b777`
- File hash: `eb0687daed29f3651c61b0a2aa4a0cdcf2049a1ebae2e15e2dd9326471d318a1`
- File hash: `f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [What AI-generated malware looks like under the microscope (Help Net Security)](https://www.helpnetsecurity.com/2026/11/04/lindsay-kaye-human-security-ai-generated-malware/)
- [VoidLink: Early AI-Generated Malware Framework (Check Point Research)](https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/)
- [VoidLink signals the start of a new era in AI-generated malware (Check Point Blog)](https://blog.checkpoint.com/research/voidlink-signals-the-start-of-a-new-era-in-ai-generated-malware/)
- [GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools (Google)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools)
- [Attackers abuse Gemini AI to develop 'Thinking Robot' malware (The Register)](https://www.theregister.com/2025/11/05/attackers_experiment_with_gemini_ai/)
- [LAMEHUG, Software S9035 (MITRE ATT&CK)](https://attack.mitre.org/software/S9035)
- [VoidLink cloud malware shows clear signs of being AI-generated (BleepingComputer)](https://www.bleepingcomputer.com/news/security/voidlink-cloud-malware-shows-clear-signs-of-being-ai-generated/)
- [VoidLink malware was almost entirely made by AI (CSO Online)](https://www.csoonline.com/article/4120607/voidlink-malware-was-almost-entirely-made-by-ai.html)
- [VoidLink shows how one developer used AI to build a powerful Linux malware (Security Affairs)](https://securityaffairs.com/187123/malware/voidlink-shows-how-one-developer-used-ai-to-build-a-powerful-linux-malware.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5218