LLM-enabled malware poses new challenges for detection and threat hunting as malicious logic can be generated at runtime rather than embedded in code. Our research discovered hitherto unknown samples, and what may be the earliest example known to date of an LLM-enabled malware we dubbed “MalTerminal.” Our methodology also uncovered other offensive LLM applications, including […]
A critical weakness in GitHub Copilot Chat discovered in June 2025 exposed private source code and secrets to attackers. Rated CVSS 9.6, the vulnerability combined a novel Content Security Policy bypass with remote prompt injection. By embedding hidden prompts in pull requests, attackers could exfiltrate private repository data and control Copilot’s responses, including injecting malicious […]
Cybersecurity company Huntress said it has observed active in-the-wild exploitation of an unpatched security flaw impacting Gladinet CentreStack and TrioFox products.
The zero-day vulnerability, tracked as CVE-2025-11371 (CVSS score: 6.1), is an unauthenticated local file inclusion bug that allows unintended disclosure of system files. It impacts all versions of the software prior to and
A sophisticated Android spyware campaign dubbed ClayRat has emerged as one of the most concerning mobile threats of 2025, masquerading as popular applications including WhatsApp, Google Photos, TikTok, and YouTube to infiltrate devices and steal sensitive user data.
The malware demonstrates remarkable adaptability and persistence, with threat actors continuously evolving their tactics to bypass security measures and expand their reach across targeted regions.
ClayRat operates as a comprehensive surveillance tool capable of exfiltrating SMS messages, call logs, device notifications, and personal information while maintaining covert access to infected devices.
The spyware’s most alarming capability lies in its ability to capture photographs using the front-facing camera and weaponize the victim’s contact list by automatically sending malicious links to every saved contact, effectively transforming each compromised device into a distribution hub for further infections.
The campaign has demonstrated explosive growth over recent months, with security researchers documenting over 600 malware samples and 50 dropper variants within a three-month period.
Each iteration introduces new layers of obfuscation and packing techniques designed to evade detection systems, showcasing the operators’ commitment to maintaining persistence against evolving security defenses.
Attackers prompting victims to join Telegram channel (Source – Zimperium)
Zimperium analysts identified the malware’s sophisticated distribution network, which primarily leverages Telegram channels and carefully crafted phishing websites that closely mimic legitimate service pages.
The attackers have registered domains that impersonate well-known services, creating convincing landing pages that redirect victims to Telegram channels where malicious APK files are hosted with accompanying installation instructions designed to bypass Android’s built-in security warnings.
Advanced Infection and Persistence Mechanisms
ClayRat employs several sophisticated techniques to establish persistent access on target devices, with its most effective strategy involving the abuse of Android’s default SMS handler role.
This privileged system role grants the malware extensive access to messaging functions without triggering standard runtime permission prompts, allowing it to read, store, and forward text messages at scale while remaining largely undetected by users.
The spyware utilizes session-based installation methods specifically designed to circumvent Android 13’s enhanced security restrictions.
Dropper variants present fake Google Play Store update screens to victims, displaying familiar installation interfaces while secretly deploying encrypted payloads stored within the application’s assets.
This approach significantly reduces user suspicion and increases installation success rates by mimicking legitimate system update procedures.
Session based installation used by the malware (Source – Zimperium)
Once successfully installed and granted SMS handler privileges, ClayRat immediately begins its surveillance operations by capturing photographs using the device’s front-facing camera and uploading them to command-and-control servers.
The malware supports an extensive range of remote commands including application enumeration, call log exfiltration, notification theft, and unauthorized SMS transmission from the victim’s device.
Communication with command-and-control infrastructure occurs through standard HTTP protocols, with the malware implementing Base64 encoding combined with marker strings such as “apezdolskynet” to obfuscate traffic patterns.
Advanced variants employ AES-GCM encryption for secure communications while utilizing dynamic payload loading from encrypted assets to further complicate analysis and detection efforts.
The malware’s self-propagation mechanism represents its most dangerous feature, automatically composing and transmitting malicious links to every contact in the victim’s phonebook, creating an exponential infection pattern that exploits social trust relationships for rapid campaign expansion.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The RondoDox campaign’s “exploit shotgun” method leverages over 50 vulnerabilities across more than 30 vendors to infiltrate network devices, highlighting the urgent need for rapid patching and continuous monitoring. The first detected RondoDox intrusion on June 15, 2025, reused a command‐injection vulnerability disclosed at Pwn2Own Toronto 2022: CVE-2023-1389, which targets the WAN interface of TP-Link […]
Cybersecurity researchers have identified what is believed to be the earliest known instance of malware that leverages a Large Language Model (LLM) to generate malicious code at runtime.
Dubbed ‘MalTerminal’ by SentinelLABS, the malware uses OpenAI’s GPT-4 to dynamically create ransomware code and reverse shells, presenting a new and formidable challenge for detection and threat analysis.
The discovery highlights a significant shift in adversary tradecraft, where the malicious logic is not hardcoded into the malware itself but is generated on-the-fly by an external AI model.
This approach can render traditional security measures, such as static signatures, ineffective, as the code can be unique for each execution. The findings were part of broader research into how threat actors are weaponizing LLMs.
A New Generation Of Adaptable Threats
Unlike other adversarial uses of AI, such as creating convincing phishing emails or using AI software as a lure, LLM-enabled malware embeds the model’s capabilities directly into its payload. This allows the malware to adapt its behavior based on the target environment.
SentinelLABS researchers established a clear definition for this threat, distinguishing it from malware simply created by an LLM, which they note remains immature.
The primary concern with LLM-enabled malware is its unpredictability. By offloading code generation to an LLM, the malware’s actions can vary significantly, making it difficult for security tools to anticipate and block its behavior.
Prior documented cases like PromptLock, a proof-of-concept ransomware, and LameHug (or PROMPTSTEAL), linked to the Russian APT28 group, demonstrated how LLMs could be used to generate system commands and exfiltrate data. These examples paved the way for hunting more advanced threats.
The breakthrough came from a novel threat-hunting methodology developed by SentinelLABS. Instead of searching for malicious code, researchers hunted for the artifacts of LLM integration: embedded API keys and specific prompt structures.
They wrote YARA rules to detect key patterns for major LLM providers like OpenAI and Anthropic. A year-long retrohunt on VirusTotal flagged over 7,000 samples with embedded keys, though most were non-malicious developer errors.
The key to finding MalTerminal was focusing on samples with multiple API keys, a redundancy tactic for malware, and hunting for prompts with malicious intent.
The researchers used an LLM classifier to score the maliciousness of discovered prompts. This strategy led them to a set of Python scripts and a Windows executable named MalTerminal.exe.
Analysis indicated that it utilized a deprecated OpenAI chat completion API endpoint, which was retired in November 2023. This suggests the malware was developed prior to that date, making it the earliest known sample of its kind.
MalTerminal prompts an operator to choose between deploying ransomware or a reverse shell, then uses GPT-4 to generate the necessary code.
“FalconShield: A tool to analyze suspicious Python files.”
Defe.py (1)
Defensive Tool
“FalconShield: A tool to analyze suspicious Python files.”
Defe.py (2)
Defensive Tool
“FalconShield: A tool to analyze suspicious Python files.”
Cyber Defensefor Threats
The emergence of malware like MalTerminal, PromptLock, and LameHug signals a new frontier in cyber defense. The primary challenge is that detection signatures can no longer rely on static malicious logic.
Furthermore, network traffic to legitimate LLM APIs can be difficult to distinguish from malicious use. However, this new class of malware has its own weaknesses. Its dependency on external APIs and the need to embed API keys and prompts within its code create new opportunities for detection.
If an API key is revoked, the malware can be neutralized. Researchers also discovered other offensive LLM tools, including vulnerability injectors and people search agents, by hunting for these artifacts.
While LLM-enabled malware is still in an experimental stage, its development gives defenders a critical opportunity to adapt their strategies for a future where malicious code is generated on demand.
ClayRat, a rapidly evolving Android spyware campaign, has surged in activity over the past three months, with zLabs researchers observing more than 600 unique samples and 50 distinct droppers. Primarily targeting Russian users, the malware masquerades as popular applications such as WhatsApp, Google Photos, TikTok, and YouTube, luring victims into installing malicious APKs via deceptive […]
Emerging from a recent wave of targeted campaigns, SnakeKeylogger has surfaced as a potent infostealer that capitalizes on PowerShell and social engineering.
The malware’s operators craft convincing spear-phishing e-mails under aliases such as “CPA-Payment Files,” impersonating reputable financial and research firms.
Recipients encounter ISO or ZIP attachments containing a seemingly innocuous BAT script. Once executed, this script downloads and launches a PowerShell payload designed to harvest keystrokes and system information before exfiltrating data to a remote server.
Gen Threat Labs analysts noted the malware’s seamless blend of legitimate Windows utilities and custom scripting for stealth and rapid deployment.
After opening the attachment, victims unwittingly activate a BAT file resembling the following snippet:
This approach bypasses standard execution policies and conceals visible windows, allowing SnakeKeylogger to operate without raising suspicion.
The PowerShell script, once loaded, establishes persistence by creating scheduled tasks and registry entries, ensuring the malware survives reboots and avoids cursory incident response efforts.
Beyond initial delivery, SnakeKeylogger’s impact lies in its minimalist but efficient data collection routines. Upon activation, the script invokes Windows API functions to capture keystrokes, clipboard contents, and active window titles.
Collected information is batched and encoded before transmission to a command-and-control server.
We are observing a new active #infostealer#SnakeKeylogger campaign. The threat is distributed via e-mails with sender aliases such as "CPA-Payment Files" impersonating CPAGlobal / @Clarivate. The e-mails contain ISO or ZIP files containing malicious BAT script downloading… pic.twitter.com/4I15XleVyH
Observed IoCs include BAT payload SHA256 hashes such as 3796e68... and the PowerShell script URL hxxp://fxa[.]sabitaxt[.]com/mc55tP.ps1, indicative of the ongoing campaign.
Infection Mechanism
SnakeKeylogger’s infection chain hinges on its two-stage loader. The initial BAT script exploits PowerShell’s unrestricted execution to retrieve the core keylogger module.
Within the PowerShell payload, the Add-Type cmdlet compiles C# code on the fly, injecting functions such as GetAsyncKeyState for low-level keystroke interception.
Persistence is achieved via a scheduled task entry resembling:-
This tactic not only reinstates the keylogger at each user login but also blends into legitimate Windows maintenance processes, complicating detection. Continuous monitoring and timely updates to endpoint protection policies are recommended to counteract this evolving threat.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Gladinet CentreStack and Triofox have come under active attack as threat actors exploit an unauthenticated local file inclusion flaw (CVE-2025-11371). The flaw lets attackers read sensitive files without logging in. Once they grab the machine key, they can trigger a view state deserialization bug to run code on the server. There is no official patch […]
A sophisticated financially motivated threat actor known as Storm-2657 has been orchestrating elaborate “payroll pirate” attacks targeting US universities and other organizations, Microsoft Threat Intelligence has revealed.
These attacks represent a concerning evolution in cybercriminal tactics, where hackers compromise employee accounts to gain unauthorized access to human resources systems and redirect salary payments to attacker-controlled bank accounts.
The campaign demonstrates the increasing sophistication of social engineering techniques combined with technical exploitation to achieve maximum financial impact.
The threat actor has been particularly active in targeting employees within higher education sectors, exploiting their access to third-party Software as a Service (SaaS) platforms like Workday.
Since March 2025, Microsoft researchers have observed 11 successfully compromised accounts at three universities that were subsequently used to launch phishing campaigns targeting nearly 6,000 email accounts across 25 different educational institutions.
The scale and precision of these operations indicate a well-resourced and methodical approach to financial fraud.
The attacks begin with carefully crafted phishing emails designed to harvest credentials through adversary-in-the-middle (AITM) phishing techniques.
These emails exploit multiple social engineering themes, including fake campus illness outbreaks with subject lines such as “COVID-Like Case Reported — Check Your Contact Status” and “Confirmed Case of Communicable Illness.”
Attack flow of threat actor activity in a real incident (Source – Microsoft)
The attackers also impersonate legitimate university communications, often referencing specific university presidents or HR departments to enhance credibility and increase victim engagement rates.
Microsoft analysts identified that Storm-2657 exploits organizations’ lack of phishing-resistant multifactor authentication, allowing them to intercept and use stolen MFA codes to gain initial access to Exchange Online accounts.
Once inside the compromised systems, the threat actors demonstrate remarkable persistence and stealth capabilities.
Technical Infiltration and Persistence Mechanisms
The technical sophistication of Storm-2657’s operations becomes evident in their post-compromise activities.
After gaining access to victim accounts, the threat actors immediately establish persistence by enrolling their own phone numbers as MFA devices within the compromised Workday profiles or Duo MFA settings.
This technique ensures continued access without requiring further MFA approval from legitimate users, effectively bypassing security controls that organizations believe protect their systems.
The attackers then create sophisticated inbox rules designed to automatically delete or hide incoming notification emails from Workday’s email service.
These rules are often named using only special characters like “….” or “\’\’\’\’” to avoid detection during casual security reviews.
This technique ensures that victims remain unaware of unauthorized changes to their payroll configurations, as the standard notification emails warning of profile modifications never reach their intended recipients.
Once persistence is established, Storm-2657 accesses Workday through single sign-on (SSO) authentication and methodically modifies victims’ salary payment configurations.
The Workday audit logs capture these activities as “Change My Account” or “Manage Payment Elections” events, providing forensic evidence of the unauthorized modifications.
Microsoft Defender for Cloud Apps can correlate these activities across both Microsoft Exchange Online and third-party SaaS applications like Workday, enabling comprehensive detection of suspicious cross-platform activities.
The attack methodology demonstrates careful planning to minimize detection while maximizing financial impact.
By leveraging legitimate authentication mechanisms and hiding evidence through automated email deletion, Storm-2657 has created a highly effective approach to financial fraud that can operate undetected for extended periods, potentially diverting multiple salary payments before discovery.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
.webp)
.webp)
.webp)
We are observing a new active 
with sender aliases such as "CPA-Payment Files" impersonating CPAGlobal / .webp)