In-app reader
7 min read
Related Products Advanced WildFireCloud-Delivered Security ServicesCortexCortex XDRCortex XSIAMUnit 42 Incident Response
By:
Published: August 25, 2026
Categories:
Tags:
Share
To assess the impact of AI-enabled malware, we collected and analyzed over 400 malware samples that integrate AI in some capacity, from brand impersonation and large language model (LLM)-generated code to agentic execution loops. Our central finding was that the AI malware space is currently overwhelmingly composed of proof-of-concept code, security validation testing and researcher submissions that have never reached a production environment.
Of the 405 samples in our dataset, only 12 appeared in our telemetry on Cortex XDR-protected endpoints, and a small subset was forwarded through Next-Generation Firewalls to WildFire for analysis. Palo Alto Networks products detected and blocked every sample that attempted to reach a customer environment.
These numbers tell a story that sits between two poles in the current discourse. AI-enabled malware is real. However, the volume of genuine operational activity remains a fraction of what public sample repositories suggest. Approximately 97% of the samples we examined exist only in sandboxes and on VirusTotal.
For defenders, the practical takeaway is straightforward. Existing behavioral detection, cloud-based sandboxing and endpoint analytics catch these threats using the same mechanisms that stop conventional malware. The AI component does not evade detection. It changes how the code is authored, not how it executes.
Palo Alto Networks customers are better protected against the threats discussed in this article through the following products and services, which detected these AI-enabled malware threats out of the box:
If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.
Related Unit 42 Topics LLM, Agentic AI, Malware
Our starting dataset consisted of 405 unique SHA-256 hashes collected from WildFire analysis reports, VirusTotal Intelligence and published open-source intelligence (OSINT) research.
The collection criteria were broad. We included any sample where AI integration was either a functional component of the malware, a feature of its delivery mechanism or part of its branding. This intentionally inclusive approach captured everything from LLM-powered ransomware agents to cryptocurrency miners that simply used “ChatGPT” in their filename.
We queried this dataset across multiple telemetry sources to measure real-world prevalence:
Endpoint presence: Cortex XDR agent telemetry from non-test tenants (December 2024–June 2025)
Network visibility: WildFire session data from samples forwarded by Next-Generation Firewalls and Cortex XDR agents (June 2024–June 2025)
Alert generation: Cortex XDR alert records for samples that triggered detection logic on endpoints
Sandbox verdicts: WildFire analysis results with malware classification
Table 1 summarizes the results of this dataset.
Telemetry Source Samples Queried Samples Discovered Prevalence in Production
Cortex XDR endpoints 405 12 3.0%
WildFire sessions 405 ~15–20 unique hashes ~4%
Cortex XDR alerts generated 12 12 100%
Table 1. Telemetry coverage across the AI malware dataset.
The disparity between the 405-sample dataset and the 12 samples observed in production environments is the most important number in this analysis. Approximately 97% of AI-enabled malware samples exist only in research repositories, sandbox environments and security validation platforms. We found no evidence that they reached a customer endpoint or traversed a customer firewall.
The following sections examine the characteristics of the dataset.
The samples that never appeared in production telemetry fall into three categories:
Proof-of-concept and research code
Security validation and testing
AI-themed brand abuse
The largest category consists of proof-of-concept implementations published to demonstrate a technique. These include:
LLM-powered ransomware frameworks with hard-coded test parameters (such as ransom addresses pointing to the Bitcoin Genesis Block, which cannot receive recoverable payments)
AI-assisted reconnaissance scripts designed for conference demonstrations
Modular attack frameworks built to test specific AI integration patterns rather than to compromise real targets
Many of these samples share common characteristics:
They target localhost or private IP address ranges in their configuration
They contain verbose debug logging that no operational threat actor would leave enabled
Their submission histories show a single upload from a security research organization or academic institution
Additionally, we found many of these samples in file paths that indicated malware analysis or research. They contained terms such as research, mal or analysis in their directory paths.
A second category comprises samples submitted by breach-and-attack simulation (BAS) platforms and internal security teams. These appear in WildFire and on VirusTotal because organizations deliberately test their detection capabilities against publicly reported AI malware samples.
The submission patterns are distinctive. They include multiple uploads of the same hash from the same organization within a short time window, often during business hours in a single time zone. They frequently come from IP addresses associated with known security testing infrastructure.
A third category uses AI branding without meaningful AI integration. Filenames reference popular AI companies or other AI products, but the payload is conventional malware wrapped in an installer that mimics an AI application.
The AI branding is a social engineering tactic, not a technical capability. These samples are real threats to the people who download them, but they do not represent a new category of AI-enabled attack.
Twelve samples from the dataset appeared on Cortex XDR-protected endpoints across organizations in three countries. They span five distinct malware families, each representing a different pattern of AI integration or AI-themed delivery. These five families are:
FunkSec ransomware
A trojanized AI application
The Oyster backdoor
The Rhadamanthys stealer
A COM hijacking DLL
The most represented family in our endpoint data is FunkSec, a ransomware strain that multiple researchers have assessed as partially generated with LLM assistance. Seven distinct variants appeared across production endpoints, compiled between Jan. 1–6, 2025. The variants share a common Rust codebase and use similar evasion techniques:
Disabling Windows Defender through PowerShell and registry modifications
Deleting volume shadow copies
Changing the desktop wallpaper to display a ransom note
The PDB paths embedded in the binaries reveal an active development cycle. Variants use project names including:
Dev.pdb
Funksec.pdb
Darkzone.pdb
Darkfunk.pdb
This is consistent with a developer iterating on the same codebase under multiple working names. Seven distinct builds in six days is a pace that suggests LLM-assisted development, where generating a new variant is closer to a prompt generation rather than a software development task.
WildFire classified all seven variants as malware. Cortex XDR generated alerts for every variant that executed on an endpoint.
The most widely encountered sample in the dataset is an NSIS installer that masquerades as a recipe-finding application called Recipe Lister. The binary is signed with a code-signing certificate issued to Global Tech Allies Ltd. — a certificate that has since been revoked. When executed, it extracts and runs a JavaScript backdoor from a temporary directory.
This sample generated the highest volume of telemetry in our dataset. It appeared across more than 50 organizations and generated over 6,500 endpoint profile records and 9,600 XDR alerts during the observation window. The alert data confirms that Cortex XDR blocked the binary across these environments through a combination of local analysis, behavioral protection and WildFire cloud verdicts. No execution succeeded on a protected endpoint.
The detection dynamics around this sample illustrate how layered defense handles AI-themed threats:
The code signature initially suppresses static detection, as the file appears legitimately signed
Behavioral analytics identify the threat through two secondary signals:
The signer is uncommon across the organization's fleet
The file entropy is near-maximum (0.999970), indicating packed or encrypted content
The WildFire cloud verdict, which arrives after the file is forwarded for sandbox analysis, provides the definitive classification and triggers the block action
One sample masquerades as a Dropbox installer and carries an Authenticode signature whose subject identity reads Dropbox, Inc . To the victim, this appears to be verified, publisher-signed software. In reality, the installer drops an AutoIt loader that side-loads the Oyster (aka CleanBoost) backdoor. The signed file is not Dropbox software, and the signature lends it false legitimacy.
Attackers are using AI tools to quickly generate the malicious code required for the initial access and delivery phases of the attack, lowering the barrier to entry and speeding up the deployment of loaders like this NSIS installer.
A .NET executable named redist.exe delivers the Rhadamanthys information stealer with active command-and-control communication. According to previous reporting, this sample was part of an AI-enabled infection chain that ultimately delivered this sample of Rhadamanthys stealer.
A DLL masquerading as a component of 360 Total Security named 360Util.dll implements persistence through COM object hijacking. The PDB path references 360Util.pdb , and the file metadata impersonates the Chinese-language product name. We included this sample in the dataset because it was delivered alongside AI-branded lures in campaigns we observed.
The gap between the volume of AI malware samples in public repositories and the volume observed in production environments reflects the current state of AI-enabled threats. AI lowers the barrier to creating malware, and the number of samples in our dataset confirms that many people are experimenting with the technique. But creating a sample and successfully deploying it against a defended environment are different problems, and malware authors have not to date succeeded at using AI to solve the second one.
The samples that did reach production environments were detected by the same mechanisms that catch conventional malware:
Sandbox detonation
Behavioral analytics
Code-signing anomaly detection
Entropy analysis
None of the AI-enabled samples in our dataset required a novel detection approach. The AI component influenced how the malware was written, but the resulting binary still exhibits the same behavioral indicators that existing detection logic targets.
This does not mean we can dismiss AI-enabled threats:
The development velocity visible in FunkSec's PDB paths suggests that LLM-assisted coding accelerates the iteration cycle for ransomware development
The trojanized AI application campaign demonstrates that AI brand recognition is an effective social engineering vector, with the sample reaching more than 50 organizations
The presence of legitimate code signatures on multiple samples shows that the delivery sophistication of AI-themed malware matches that of conventional threats
Telemetry data does not reveal statistically significant targeting patterns across the samples. The encounters span three countries and industries with no concentration in any single sector or geography. This is consistent with opportunistic operations rather than targeted campaigns directed at specific organizations or verticals.
The absence of targeting patterns is itself informative. AI-enabled malware, at this stage of adoption, follows the same distribution model as most offensive cyber activity. Threat actors are integrating AI capabilities into tools that they’ve deployed broadly rather than reserving them for operations against specific high-value targets.
When evaluating AI in the current malware landscape, it should not be categorized as mere hype or altogether dismissed. AI-enabled malware is a real and growing category, but our current defensive frameworks detect and block AI-enabled malware regardless of the role that use of AI played in its development. Organizations that maintain strong defense in depth are well positioned to detect these threats as they evolve.
Palo Alto Networks customers are better protected from the threats discussed above through the following products, which detected these AI-enabled malware threats out of the box:
The Advanced WildFire machine-learning models and analysis techniques identify indicators shared in this research.
Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware and prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.
If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:
North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
UK: +44.20.3743.3660
Europe and Middle East: +31.20.299.3130
Asia: +65.6983.8730
Japan: +81.50.1790.0200
Australia: +61.2.4062.7950
India: 000 800 050 45107
South Korea: +82.080.467.8774
Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.
Table 2 lists the samples assessed as genuine threat actor activity.
SHA256 hash Family
1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7 Trojanized application (RecipeLister)
5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd FunkSec ransomware
dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac FunkSec ransomware
66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd FunkSec ransomware
c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c FunkSec ransomware
e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22 FunkSec ransomware
b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb FunkSec ransomware
20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d FunkSec ransomware
dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966 FunkSec ransomware
c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef COM hijacking DLL
bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7 Oyster backdoor/CleanBoost
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14 Rhadamanthys stealer
Table 2. Samples observed on production endpoints.
Analyzing the Current State of AI Use in Malware — Palo Alto Networks, Unit 42
**Back to top
Threat Research Center Next: Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Almost Half of Malware Samples Communicate Direct to IP
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Threat Research August 20, 2026 Identity Abuse Through Trusted Communication Channels
Threat Research August 11, 2026 Kimwolf v7: An Evolution of the Kimwolf Botnet
Threat Research August 10, 2026 The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
High Profile Threats August 6, 2026 ChainDrop: Inside a Self-Propagating npm Worm
Threat Research August 6, 2026 Token Jacking: Cybercriminals Could Be Stealing Your AI Resources
Threat Research August 4, 2026 Almost Half of Malware Samples Communicate Direct to IP
Threat Research August 3, 2026 Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
Threat Research July 31, 2026 The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
High Profile Threats July 15, 2026 The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
[Read now](htt
…(truncated for reading performance)
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.