GTIG Discloses PROMPTFLUX: First "Just-in-Time" Self-Obfuscating AI Malware Using the Gemini API

What Happened

In its November 5, 2025 "GTIG AI Threat Tracker" report, Google's Threat Intelligence Group disclosed that it had identified, first observed in early June 2025, an experimental VBScript dropper malware family it named PROMPTFLUX. Unlike conventional malware that hardcodes its evasion logic, PROMPTFLUX calls the Gemini API mid-execution and asks the LLM to generate new obfuscation/antivirus-evasion code on demand, then saves the freshly obfuscated version of itself to the Windows Startup folder for persistence. GTIG described this as the first documented example of "just-in-time" AI-assisted malware: code that uses an LLM to dynamically rewrite its own behavior during execution rather than relying on static, pre-written logic. The same report also disclosed four other AI-enabling malware families (PROMPTSTEAL, PROMPTLOCK, FRUITSHELL, QUIETVAULT) as part of a broader finding that threat actors were moving from using AI for productivity/coding help toward embedding live AI calls inside malware itself. Google stated PROMPTFLUX remained in a development/testing stage, had not been shown capable of compromising any real victim system, and that it had disabled the Gemini assets (API keys, projects, accounts) associated with the activity.

How the Attack Worked

PROMPTFLUX is a VBScript dropper that first decodes and executes an embedded decoy installer to mask its activity (GTIG cited a lure filename pattern like "crypted_ScreenRec_webinstall"). Its distinguishing feature is a "Thinking Robot" module: using a hardcoded Gemini API key, it sends a POST request to the Gemini API endpoint specifying the "gemini-1.5-flash-latest" model (the "-latest" tag keeps it pinned to the current stable release so the malware survives model deprecation). The prompt is narrow and machine-parsable: it asks the LLM to return only new VBScript antivirus-evasion/obfuscation code, no explanation or formatting, and the malware logs every AI response to "%TEMP%thinking_robot_log.txt." A self-replacement function (AttemptToUpdateSelf) existed in the analyzed sample but was commented out/disabled, though its presence plus the active response-logging indicated the author's intent to build a fully metamorphic script. GTIG also found variant samples where the "Thinking Robot" function was replaced by a "Thinging" function that instructs Gemini (prompted to act as an "expert VBScript obfuscator") to rewrite the malware's entire source code on an hourly cadence, each time re-embedding the original decoy payload, the hardcoded API key, and the self-regeneration logic, creating a recursive, self-sustaining mutation cycle. The malware also attempted to spread by copying itself to removable drives and mapped network shares. GTIG noted the code family showed signs of being in active development/testing (incomplete features commented out, a mechanism limiting the number of Gemini API calls) rather than a finished operational tool.

The Lure & the Tell

Lure: a decoy/installer file with names such as "crypted_ScreenRec_webinstall" (mimicking a screen-recording software installer) used to entice a victim into executing the dropper, a broad, non-geography-specific social-engineering pretext designed to work on many kinds of users rather than a bespoke targeted lure. The "tell": GTIG could find no evidence the current sample ever succeeded in compromising a real network or device. Key giveaways researchers used included the malware's self-limiting mechanism on Gemini API calls, disabled/commented-out self-update code, and the diagnostic log file it left in %TEMP%, all pointing to a tool still being tested rather than one already weaponized in a live intrusion.

Outcome

Not a completed breach. GTIG explicitly assessed PROMPTFLUX as being in a development-or-testing phase: some features were incomplete/commented out (including the core self-replacement function) and a mechanism existed to cap the number of Gemini API calls the malware could make. GTIG stated the current samples did not demonstrate an ability to compromise a victim network or device. Google's response was to disable the API keys, projects, and accounts tied to the activity, and to use the findings to strengthen Gemini's classifiers and the model's refusal behavior against this abuse pattern going forward. No named victim, breach, or financial loss was attributed to PROMPTFLUX itself.

Why It Matters

PROMPTFLUX is significant as a proof-of-concept demonstration, documented by a major cloud/AI provider rather than alleged by a third party, that malware can outsource its own code-mutation and evasion logic to a live LLM API call instead of hardcoding it, producing a metamorphic payload that changes every run (or, in the "Thinging" variant, every hour) without any human attacker intervention. Even though GTIG assessed it as experimental and non-operational at disclosure, it establishes a template threat actors (financially motivated or state-sponsored) could mature: signature-based antivirus becomes structurally weaker against payloads that regenerate via API call, and defenders must add new detection surfaces (outbound calls to generative-AI endpoints, hardcoded-API-key artifacts, anomalous Startup-folder writes) that traditional malware analysis did not need to watch. It also illustrates a new AI-provider responsibility: Google's mitigation was not a patch to a victim's network but disabling of its own API assets and hardening of Gemini's model/classifiers, making the LLM vendor itself a first-line defender against its API being used as a real-time malware-development oracle.

Defenses

GTIG's own writeup doubles as the defense playbook: (1) Google disabled the Gemini API keys, projects, and accounts associated with the PROMPTFLUX activity and applied the findings to harden Gemini's classifiers/model against being used this way going forward (per the companion "Advancing Gemini's Security Safeguards" work). (2) Detection guidance for defenders emphasizes behavioral/heuristic monitoring rather than static signatures, since the payload is designed to mutate every run/hour: watch for VBScript processes making outbound HTTPS POSTs to generativelanguage.googleapis.com or other LLM API endpoints, unexpected script-writing to the Startup folder, and log artifacts like a "thinking_robot_log.txt" style file in %TEMP%. (3) Restrict or monitor egress from user endpoints to generative-AI API domains as a network control. (4) AI providers should rate-limit/anomaly-detect abusive API-key usage patterns (repetitive obfuscation-style prompts) and enforce prompt/output content policies; GTIG notes it disabled the assets and improved model refusal behavior for this exact abuse pattern. (5) For social-engineering-flavored prompt injection observed elsewhere in the same report (actors posing as CTF students/security researchers to jailbreak Gemini), model providers are tightening guardrail training against pretext-based prompts.