AI-powered malware is making a familiar security problem harder to contain. Instead of keeping the same code long enough for antivirus tools to recognize it, these programs can alter their form repeatedly while retaining the same harmful purpose.
The emerging model relies on large language models as an automated code factory. A malicious dropper can request a newly obscured version of itself at regular intervals, while related tools can generate short commands for collecting documents.
That reduces the time and specialist skill traditionally needed to create fresh samples. Morphisec analysts noted the shift after reviewing reports of PROMPTFLUX, an experimental dropper disclosed by Google’s threat researchers in late 2025.
The sample reportedly queried the Gemini API about once an hour and regenerated obfuscated code, with researchers seeing more than 70 variants in under four hours.
Morphisec said in a report shared with Cyber Security News (CSN) that the immediate concern is not a confirmed mass campaign but the pressure this puts on signature-led controls.
Static hashes and known file patterns lose value when every copy differs. The danger grows when self-changing code is paired with memory-only activity, an approach explored in this guide to how fileless malware works.
AI-Powered Malware Rewrites Itself Every Hour
Traditional polymorphic malware commonly encrypts or disguises a payload while leaving part of its underlying logic unchanged.
AI-assisted malware can go further by replacing code blocks altogether. That moves it closer to metamorphic behavior, where defenders may find no reliable core to fingerprint across samples.
PROMPTFLUX is the clearest example cited in the report, but it is part of a wider pattern. PROMPTSTEAL can use a model to create single-line Windows commands for document collection, while PromptLock and BlackMamba have been described as using language models to alter payloads during operation.
Earlier reporting on AI malware evading security tools shows why this capability has drawn growing attention. For a security team, the practical issue is speed. A detection rule is normally written after analysts identify a suspicious file, command, or behavior.
If the malware changes before that rule reaches endpoints, the rule may only catch an older sample and leave the next version untouched.
That does not mean signatures are useless. They remain important for known threats, investigations, and blocking repeated activity.
However, defenders should avoid treating a clean scan as proof that a newly delivered program is safe, particularly when it launches scripts, uses built-in tools, or runs mainly in memory.
Defenders Need Earlier Controls
A prevention-first approach is needed because the malicious code still must execute, regardless of how often it changes. Its recommended model focuses on blocking the execution conditions rather than first identifying a specific strain.
The report describes changing the runtime memory environment at process launch and presenting decoys where an attack expects to find resources.
The vendor argues that this can interrupt an unknown payload before encryption, data theft, or movement to other systems. Organizations should independently test such controls alongside their existing endpoint tools.
A more balanced response also starts with basic exposure reduction. Keep operating systems and internet-facing applications patched, restrict unnecessary scripting and administrative utilities, and investigate unusual child processes or commands that access large collections of documents.
Guidance on detecting fileless malware attacks offers useful context for monitoring activity that may not leave a normal executable behind. Teams should preserve endpoint telemetry and make incident plans account for short-lived variants.
Analysts need to look for the underlying action, such as suspicious credential access, unexpected archive creation, outbound connections, or unusual use of trusted tools, rather than relying only on a filename or hash.
Routine tabletop exercises should include a case where the original sample disappears before triage. That helps responders prioritize containment, evidence capture, and recovery over a race to label the malware.
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
The post AI-Powered Malware Rewrites Itself Every Hour to Evade Signature-Based Detection appeared first on Cyber Security News.