Recently, security researchers from Google discovered two new types of malware that are quite concerning, namely PromptFlux and PromptSteal. At first glance, they may sound like futuristic project names, but these two are not ordinary experiments. They already “use their brains” — leveraging artificial intelligence (AI) and large language models (LLM) such as Gemini and Qwen to carry out their operations.
While most malware typically spreads, infiltrates, and damages systems, these two new variants can think and adapt. They are capable of rewriting or modifying their own code to evade security detection. In other words, modern malware is not only intelligent but also cunning and dynamic.
Need a Professional Website? Or a Team to Maintain Yours?
Bring your institution (agency, organization, or work unit) to a more modern and professional look with our professional website development service — responsive, secure, and aligned with your brand identity.
Keep your website running smoothly with our website maintenance service.
Tap the WhatsApp button below to consult directly with the SIMPLIFY team and start receiving our best service.
[vc_row][vc_column][vc_btn title=”WhatsApp” style=”classic” shape=”round” color=”success” align=”left” i_icon_fontawesome=”fa fa-whatsapp” css_animation=”none” add_icon=”true” link=”url:https%3A%2F%2Fwa.me%2F%2B628998706033|target:_blank”][/vc_column][/vc_row]
Or save the SIMPLIFY contact — you might need it someday.
PromptFlux: A Malware That Can “Evolve”
PromptFlux is described as an experimental malware with the ability to regenerate its code through the Gemini API. Each time it runs, the malware slightly alters its code structure. As a result, the signature (unique identifier) usually used by antivirus software becomes ineffective since each version of the malware appears different.
Like digital camouflage, every time it’s detected, PromptFlux immediately “changes its colors and form” to stay hidden. This way, the malware can continue to survive and spread without being easily tracked.
PromptSteal: More Advanced and More Dangerous
While PromptFlux is still considered experimental, PromptSteal has already been used in real-world attacks. Google reported that this malware has been utilized by the Russian hacker group (APT28) to steal data from victims’ computers.
What makes it even more dangerous is that PromptSteal uses AI Qwen to automatically write Windows command line instructions. Because each command is generated dynamically, there is no consistent pattern that security systems can detect. As a result, this malware can exfiltrate data, run in the background, and erase traces without being easily noticed.
Threats in the Age of AI
The emergence of these two malware types clearly shows that we have entered a new era of cybersecurity — an era where malware is not entirely created by humans but also powered by artificial intelligence. This means that traditional antivirus systems relying solely on signatures are no longer sufficient.
Going forward, the behavioral detection approach will be key. Security systems must be able to recognize unusual activities such as files that constantly change, scripts that call AI APIs, or mysterious connections to LLM servers. Behavioral-based detection is far more effective in dealing with evolving threats like these.
Read also: Indirect Prompt Injection
What Can We Do?
For digital professionals — whether developers, server administrators, or website managers — this threat serves as an important reminder. Some basic steps that should be applied include:
- Be cautious with scripts or plugins from unknown sources.
- Always update your systems and security software.
- Limit API access on servers, especially those connected to external AI services.
- Regularly monitor server activity, including outgoing connection logs.
When AI is exploited for malicious purposes, its impact can be far more dangerous than traditional viruses. Today, we must not only stay vigilant but also be smarter than malware that can “think.”
