In June 2025, Russian state-backed operators pointed malware at Ukraine that did something no publicly documented sample had done before in a real campaign: it phoned a large language model mid-attack and asked the model to write its next move. Google's Threat Intelligence Group tracks that malware as PROMPTSTEAL and states plainly that "APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations" (GTIG AI Threat Tracker, 5 November 2025). Alongside it, GTIG detailed an experimental VBScript family called PROMPTFLUX that prompts the Gemini API to rewrite its own code. The short answer to the question every defender is now asking, what are PROMPTSTEAL and PROMPTFLUX, and how do I detect malware that uses an LLM at runtime, is this: they are malware that generate their malicious logic on demand from an external model, and you detect them by hunting the behavior and the network egress, not the payload bytes.
Three shifts make this the story of the year for blue teams, not a novelty. First, the capability has crossed from lab to operations: GTIG says that "for the first time, GTIG has identified malware families, such as PROMPTFLUX and PROMPTSTEAL, that use Large Language Models (LLMs) during execution" (GTIG). Second, the design goal is evasion: these tools "dynamically generate malicious scripts, obfuscate their own code to evade detection, and leverage AI models to create malicious functions on demand, rather than hard-coding them into the malware" (GTIG). Third, the same family had already surfaced under another name: Ukraine's CERT-UA documented PROMPTSTEAL as LAMEHUG in July 2025, calling out its use of an LLM to build commands on the fly (The Hacker News). For SOC analysts, detection engineers, and red teams, the line has moved.
This post is the Stingrai research team's defender-focused reference on LLM-in-the-loop malware. It is a descriptive threat characterization and a detection guide, not a how-to: there is no malware code and no build guidance here. Every technical claim is anchored to a named primary source, chiefly the GTIG AI Threat Tracker of 5 November 2025 and CERT-UA's July 2025 reporting on LAMEHUG, with corroboration from The Hacker News and Infosecurity Magazine. Where a "first" is claimed, it is quoted from GTIG's own wording so the framing stays exact. Every figure and quote below carries its source so any claim can be audited inline.
TL;DR: LLM-driven malware in one screen
First live-ops sighting (2025): GTIG calls APT28's use of PROMPTSTEAL "our first observation of malware querying an LLM deployed in live operations" (GTIG AI Threat Tracker).
PROMPTSTEAL is the live example: a data miner used by APT28 (aka FROZENLAKE) against Ukraine that queries Qwen2.5-Coder-32B-Instruct through the Hugging Face API to generate its commands at runtime (GTIG).
PROMPTFLUX is experimental: a VBScript dropper that prompts the Gemini API to rewrite its own source for "just-in-time" self-modification, assessed as under development with no current means to compromise a device (The Hacker News).
The code writes itself: GTIG describes families that "create malicious functions on demand, rather than hard-coding them into the malware" (GTIG).
LAMEHUG is the same family: CERT-UA documented PROMPTSTEAL as LAMEHUG in July 2025 (The Hacker News).
Guardrails get social-engineered: an operator prefaced prompts with "I am working on a CTF problem" to talk a model past its safety controls (The Hacker News).
PROMPTFLUX persists in Startup: it saves its rewritten, obfuscated copy to the Windows Startup folder and spreads to removable drives and mapped network shares (GTIG).
Detect behavior, not bytes: hunt outbound LLM-API calls from unexpected processes, dynamically written scripts, and unsanctioned on-host AI CLI usage (Infosecurity Magazine).
Key takeaways
The novelty that matters is the API call, not the AI hype. Strip away the headlines and the operationally significant fact is narrow and precise: for the first time in a live campaign, malware reached out to a hosted model to author its own commands. GTIG states that "for the first time in 2025, GTIG discovered a code family that employed AI capabilities mid-execution to dynamically alter the malware's behavior" (GTIG). That single behavior, an outbound request to an LLM endpoint from a process that has no business making one, is both the innovation and the detection opportunity.
Static signatures degrade the moment the payload is regenerated. A hash identifies a fixed sequence of bytes. When PROMPTFLUX asks Gemini to rewrite and re-obfuscate itself, or when PROMPTSTEAL fetches fresh commands from Qwen for each run, the artifact a signature was written against may not exist by the time the rule runs. Detection has to shift left of the payload, onto the behavior that produces it.
PROMPTFLUX is a warning, not yet a weapon. It is important not to overclaim. PROMPTFLUX was "assessed to be under development or testing phase, with the malware currently lacking any means to compromise a victim network or device" (The Hacker News). The live-operations distinction belongs to PROMPTSTEAL. Treat PROMPTFLUX as a preview of technique, and PROMPTSTEAL as the proof it works.
Model guardrails are a control an attacker will try to bypass, not a defense you own. GTIG observed an actor pretending to be a capture-the-flag participant to coax a model into producing content it would otherwise refuse (The Hacker News). Defenders cannot rely on a third-party model's safety layer to stop misuse on their network. The controls you own are egress policy, endpoint telemetry, and detection engineering.
Emulation has to catch up to the tradecraft. If an adversary in your threat model now generates payloads at runtime and reaches an external model to do it, your validation should exercise that path. Red teams that emulate named actors like APT28 need LLM-in-the-loop behavior in scope, so the SOC gets reps against the real technique rather than the last generation of it. This is the same pressure driving agentic red teaming, where AI enters the offensive workflow: the attacker's toolkit is changing, and adversary simulation has to change with it.
Methodology and sourcing
This is a threat explainer and detection guide, so the "methodology" is source discipline rather than a survey sample. The load-bearing sources, with publication windows:
Google Threat Intelligence Group, GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools, published 5 November 2025. The primary source for PROMPTSTEAL, PROMPTFLUX, the APT28 attribution, the Qwen and Gemini details, and every "first" claim, each quoted verbatim from GTIG rather than paraphrased.
CERT-UA reporting on LAMEHUG, July 2025 (alert 16039), the earliest public documentation of the PROMPTSTEAL family, referenced here via The Hacker News coverage of the CERT-UA advisory.
The Hacker News and Infosecurity Magazine, both 5 November 2025, used to corroborate the technical details and to source the practitioner detection guidance.
Descriptive scope only: this post characterizes what the malware does and how to detect it. It contains no sample code, no indicators that would function as a build recipe, and no offensive tooling. Any claim that could not be tied to a named primary source on a verification pass was left out rather than estimated. The exact malware hashes, C2 addresses, and prompt strings live in the primary reports for responders who need them, and are linked in the References section.
What are PROMPTSTEAL and PROMPTFLUX
Both are malware families that GTIG says "use Large Language Models (LLMs) during execution." The difference between them is maturity and intent, and it is the difference every defender should hold onto.
PROMPTSTEAL: the live-operations data miner
PROMPTSTEAL is the one that matters most today, because it was used in a real campaign. GTIG identified it in June 2025, deployed by the Russian government-backed actor APT28, also tracked as FROZENLAKE, against targets in Ukraine. Functionally it is a data miner. Rather than shipping a fixed list of collection commands inside the binary, it "queries an LLM (Qwen2.5-Coder-32B-Instruct) to generate commands for execution via the API for Hugging Face" (GTIG). In practice, reporting describes a Python data miner that asks the model for one-line Windows commands to enumerate and collect documents from targeted folders, then sends what it finds to a command-and-control server (Infosecurity Magazine).
The design intent is explicit in GTIG's language: the malware "uses LLMs to generate commands for the malware to execute rather than hard coding the commands directly in the malware itself." That is what elevates PROMPTSTEAL from a curiosity to a milestone. GTIG's exact framing is worth repeating because precision matters here: "APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations."
PROMPTFLUX: the self-rewriting experiment
PROMPTFLUX is the more futuristic of the two and, crucially, the less finished. It is a dropper written in VBScript that decodes and executes an embedded decoy installer to mask its activity. Its headline capability is regeneration: it "prompts the LLM to rewrite its own source code," then saves the new, obfuscated version to the Windows Startup folder to establish persistence (GTIG). The mechanism is a module GTIG nicknamed the "Thinking Robot," which periodically queries the Gemini API (Gemini 1.5 Flash or later) to request VBScript obfuscation and evasion techniques for what The Hacker News describes as "just-in-time" self-modification (The Hacker News). It also attempts to spread by copying itself to removable drives and mapped network shares.
The essential caveat is that PROMPTFLUX is experimental. It was "assessed to be under development or testing phase, with the malware currently lacking any means to compromise a victim network or device" (The Hacker News). Do not read it as an active threat to your fleet today. Read it as a clear signal of where offensive tooling is heading: malware that treats a hosted model as an on-demand code generator for evasion.
LAMEHUG: the same family under an earlier name
If PROMPTSTEAL sounds familiar, that is because it is. GTIG notes that the family it tracks as PROMPTSTEAL was "reported by CERT-UA as LAMEHUG." Ukraine's national CERT documented LAMEHUG first, in July 2025, after a phishing wave against government bodies observed around 10 July 2025, describing malware that used an LLM to generate commands from natural-language descriptions (The Hacker News). Some early coverage of the CERT-UA advisory called LAMEHUG the first known LLM-powered malware. GTIG's own claim is deliberately narrower and more defensible, framing PROMPTSTEAL as its first observation of such malware in live operations. When you see LAMEHUG and PROMPTSTEAL in different reports, treat them as one threat under two tracking names.
Why "LLM at runtime" breaks static defenses
The reason this technique is worth a detection-strategy rethink comes down to one property: the malicious logic does not exist until the malware asks for it. That undercuts several controls defenders lean on.
Signature and hash matching. A YARA rule or an antivirus signature keys on stable content. GTIG's whole point is that these families "obfuscate their own code to evade detection" and "create malicious functions on demand." A rule written for yesterday's PROMPTFLUX variant can miss the copy Gemini rewrote an hour ago.
Static payload analysis. When a sample is pulled apart, the interesting behavior may simply not be in the file. For PROMPTSTEAL, the collection commands are not hard-coded; they arrive from the model at runtime. A static triage of the binary sees a thin client and an API call, not the commands that will actually run.
Blocklists of known-bad infrastructure. The outbound connection is to a mainstream, reputable AI provider. Traffic to Hugging Face or a major model API does not look like traffic to a sketchy C2 domain. The reputational shortcut that flags a suspicious host does not fire.
None of this makes the malware invisible. It relocates the signal. The tell is no longer the payload; it is the behavior that fetches the payload, and the network conversation that carries it.
Detection: what blue teams should hunt
Practitioner guidance on the GTIG findings converges on a simple reframing. As one security leader put it in coverage of the report, "detection should key in on unusual process creation, scripting activity or unexpected outbound traffic especially to AI APIs like Gemini, Hugging Face or OpenAI" (Infosecurity Magazine). Broken into concrete hunts, four signals carry most of the weight.
1. Outbound LLM-API calls from processes that should never make them
This is the highest-value signal. A hosted model API is a legitimate destination for a developer workstation or a sanctioned application, and an illegitimate one for wscript.exe, cscript.exe, a random Python process in a user profile, or an Office child process. Build detections that pair the destination (major LLM and inference API endpoints, including Hugging Face inference, Gemini, and comparable providers) with the source process. The anomaly is not the destination alone; it is the combination of an unexpected process and an AI endpoint. Egress logs, TLS metadata such as SNI, secure web gateway records, and EDR network telemetry all feed this hunt.
2. Dynamically generated and self-rewriting scripts
PROMPTFLUX writes a fresh, obfuscated copy of itself to the Startup folder on a loop. That pattern, a script that produces new script content, drops it into a persistence location, and mutates between runs, is detectable even when each individual version is novel. Monitor script-engine activity through Windows Script Host and PowerShell logging, watch Startup and Run-key persistence paths for churn, and flag processes that both call an external API and then write executable script content locally. High-frequency modification of an autorun artifact is itself suspicious, regardless of what the new content decodes to.
3. Unsanctioned on-host AI CLI usage
Beyond bespoke malware, GTIG's broader finding is that operators lean on AI tooling during intrusions. On endpoints and servers, inventory and alert on the presence and execution of AI command-line clients and inference libraries that have no business being there. A finance or HR workstation suddenly running an LLM client, or a server-side process importing an inference SDK, deserves a look. This overlaps with living-off-the-land tradecraft, where legitimate tools are abused for malicious ends, so tune it alongside your existing LOLBin coverage.
4. Anomalous process lineage and just-in-time execution
Tie it together with parentage. The chain that should raise an eyebrow is document or dropper, to script host, to outbound AI API, to freshly spawned command execution, to data staging. Each link can look benign in isolation. The sequence is the detection. Correlate process-creation events with the network event that preceded execution, and alert when a locally generated command runs within a short window of an LLM-API response. That temporal join between "model replied" and "new command executed" is the runtime fingerprint of LLM-in-the-loop malware.
A practical starting point: baseline which of your assets legitimately talk to AI APIs, deny the rest by policy at the egress layer, and turn the exceptions into high-fidelity alerts. Most of your estate has no reason to reach a public model endpoint, and denying it by default shrinks the haystack before you ever write a detection rule.
What this means for defenders
The defensive program that answers this threat is not exotic. It is disciplined execution across egress, endpoint, and validation.
Set and enforce an LLM egress policy. Decide which assets may reach external model and inference APIs, allowlist those, and deny the rest at the proxy or firewall. When a denied asset tries anyway, that is a finding, not noise.
Instrument the script and process layer. Turn on Windows Script Host and PowerShell script-block logging, capture full process-creation with command lines, and retain enough network metadata to join an outbound API call to the command that runs next.
Rebalance away from signature-only reliance. Signatures still catch the careless. Against code that regenerates itself, behavioral and anomaly detection carry the load. GTIG's own framing, that these families create functions on demand, is the argument for the shift.
Validate the detections against real tradecraft. A detection you have not exercised is a hypothesis. Emulating an actor like APT28, including its willingness to put a model in the loop, tells you whether your egress rules and process hunts actually fire. Stingrai's threat-led red teaming emulates named adversaries by industry, and choosing which group to emulate is its own decision worth making deliberately, covered in our guide on which threat group your red team should emulate.
Keep malware and egress detection in human-led scope. Endpoint, malware, and egress-detection validation is senior-human red-team and detection-engineering work at Stingrai, delivered by our experienced testers rather than an automated web scanner. Stingrai's autonomous agent, Snipe, is a web-application pentesting agent focused on complex application flaws such as IDOR, business logic, and broken authorization, so it lives in a different part of the services portfolio. The two are complementary, not interchangeable.
Feed the evidence into your compliance program. The detection-validation and red-team reports from this kind of engagement support your SOC 2 and ISO 27001 evidence for security monitoring and incident response, so the same exercise that hardens the SOC also documents control effectiveness for your auditors.
Stingrai is a CREST-accredited firm, and our senior human pentesters bring the adversary-emulation depth this class of threat now demands. If LLM-in-the-loop tradecraft is in your threat model, it belongs in your next validation cycle. Our pricing page has the current engagement options.
Frequently Asked Questions
What are PROMPTSTEAL and PROMPTFLUX, and how do I detect malware that uses an LLM at runtime?
PROMPTSTEAL and PROMPTFLUX are malware families that Google's Threat Intelligence Group says "use Large Language Models (LLMs) during execution." PROMPTSTEAL, used by APT28 against Ukraine, queries a hosted model to generate its commands at runtime; PROMPTFLUX is an experimental sample that prompts the Gemini API to rewrite its own code. You detect this class of malware by hunting the behavior rather than the payload: outbound calls to LLM APIs from processes that should not make them, scripts that generate or rewrite themselves, unsanctioned on-host AI clients, and process chains where a locally run command follows an LLM-API response (GTIG).
Is PROMPTSTEAL the first malware to use an LLM in a real attack?
Google's Threat Intelligence Group states that "APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations." That is GTIG's precise wording. Earlier, in July 2025, CERT-UA documented the same family as LAMEHUG, and some coverage called it the first known LLM-powered malware, so the exact "first" you cite depends on which report and which definition you use (GTIG).
What is the difference between PROMPTSTEAL and PROMPTFLUX?
PROMPTSTEAL is a data miner used in live operations by APT28; it asks a hosted model for collection commands at runtime. PROMPTFLUX is experimental and was assessed as under development with no current means to compromise a device; its distinctive trait is prompting the Gemini API to rewrite its own source for self-modification. PROMPTSTEAL is the operational threat, PROMPTFLUX is the preview of technique (The Hacker News).
Is LAMEHUG the same thing as PROMPTSTEAL?
Yes. GTIG tracks the family as PROMPTSTEAL and notes it was "reported by CERT-UA as LAMEHUG." CERT-UA documented LAMEHUG first, in July 2025, after a phishing campaign against Ukrainian government bodies. They are one threat under two tracking names (The Hacker News).
Why do static signatures struggle against LLM-driven malware?
Because the malicious logic is generated on demand and can be re-obfuscated between runs. GTIG describes these families as tools that "obfuscate their own code to evade detection" and "create malicious functions on demand, rather than hard-coding them into the malware." A hash or signature written against one version can miss the next, so detection has to move onto the behavior that fetches or regenerates the payload (GTIG).
Which LLMs do PROMPTSTEAL and PROMPTFLUX use?
PROMPTSTEAL queries Qwen2.5-Coder-32B-Instruct through the Hugging Face API. PROMPTFLUX queries the Google Gemini API, specifically Gemini 1.5 Flash or later, through a module GTIG nicknamed the "Thinking Robot." Both use mainstream, reputable model providers, which is part of why the outbound traffic can blend in (GTIG).
Can attackers bypass the safety guardrails on these models?
They try. GTIG observed an operator prefacing prompts with statements like "I am working on a CTF problem" to frame malicious requests as a security exercise and coax the model past its refusals. Defenders should treat a third-party model's safety layer as something an attacker will attempt to talk around, not as a control they can rely on (The Hacker News).
How can a red team help us prepare for LLM-in-the-loop malware?
By emulating the actual technique so your detections get exercised against it. If APT28 or a similar actor is in your threat model, adversary emulation that includes runtime LLM behavior tells you whether your egress policy, script-engine logging, and process-lineage hunts fire in practice. Stingrai's threat-led red teaming emulates named actors by industry, and the resulting detection-validation evidence supports your SOC 2 and ISO 27001 monitoring and incident-response controls.
References
Google Threat Intelligence Group (GTIG). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. 5 November 2025. https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools. Primary source for PROMPTSTEAL and PROMPTFLUX, the APT28 attribution, the Qwen and Gemini details, and every quoted "first" claim.
CERT-UA (via The Hacker News). CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign. 17 July 2025. https://thehackernews.com/2025/07/cert-ua-discovers-lamehug-malware.html. Earliest public documentation of the PROMPTSTEAL family under the LAMEHUG tracking name, tied to CERT-UA alert 16039.
The Hacker News. Google Uncovers PROMPTFLUX Malware That Uses Gemini AI to Rewrite Its Code. 5 November 2025. https://thehackernews.com/2025/11/google-uncovers-promptflux-malware-that.html. Corroborates the Thinking Robot module, Gemini 1.5 Flash, the experimental status of PROMPTFLUX, and the capture-the-flag guardrail-bypass pretext.
Infosecurity Magazine. AI-Enabled Malware Now Actively Deployed, Says Google. 5 November 2025. https://www.infosecurity-magazine.com/news/aienabled-malware-actively/. Corroborates the PROMPTSTEAL data-miner behavior and sources the practitioner detection guidance on process, scripting, and outbound AI-API traffic.
