Google found PROMPTFLUX, a dropper that asks Gemini for antivirus-evasion code mid-run. Its self-rewrite feature was switched off and it hit no one.
Social Engineering Examples·6 sources
PROMPTFLUX malware asks Google's Gemini to help it hide. Google's Threat Intelligence Group (GTIG) first spotted the VBScript dropper in June 2025 and disclosed it on 5 November 2025. Mid-run, it sends Gemini a prompt asking for fresh antivirus-evasion code, then writes the answer to a log file. The part that would swap that code into the running malware is there, but switched off. GTIG says it doesn't show any ability to compromise a device or network. Status: Experimental sample; no victims.
| Piece | What GTIG found |
|---|---|
| Cover | A VBScript dropper that runs a decoy installer to mask what it's doing |
| "Thinking Robot" | Uses a hard-coded Gemini API key to ask "gemini-1.5-flash-latest" for VBScript evasion code. The "-latest" tag keeps it working when models are retired |
| The prompt | "Highly specific and machine-parsable", asking for the code only |
| The output | Every reply is logged to thinking_robot_log.txt in the TEMP folder |
| Spread | Code to copy itself to removable drives and mapped network shares |
| Brakes | A limit on how many Gemini calls it can make |
One variant swaps in a "Thinging" function whose prompt tells Gemini to rewrite the malware's entire source code every hour. That's what the prompt asks for. GTIG reports no rewritten version that was produced, saved or run, and doesn't say whether Gemini complied or refused.
Tip: if you run AI APIs, a hard-coded key in someone else's script is a key you've lost. Rotate keys and watch for odd usage.
Here's the detail that matters most. The function that would replace the running script with Gemini's answer, AttemptToUpdateSelf, is commented out. So in the sample GTIG analysed, PROMPTFLUX asks for code and saves the answer to a text file. That's all.
GTIG's own summary table says the malware saves new obfuscated versions to the Startup folder for persistence. That describes the design goal, and it clashes with GTIG's technical write-up of the actual samples. Follow the technical write-up.
GTIG didn't attribute it to any group. From the file names, it guessed at a financially motivated actor rather than a state.
| Family | What it does with AI |
|---|---|
| PROMPTFLUX | Designed to rewrite itself via Gemini. Never used against anyone |
| PROMPTSTEAL (LAMEHUG) | Asked a model for commands in live operations, attributed to APT28. Doesn't rewrite itself |
| FRUITSHELL | Calls no model. Carries prompts meant to fool AI-powered security tools |
| QUIETVAULT | Uses AI command-line tools already installed on the machine |
| PROMPTLOCK | An academic proof of concept, published by ESET, not GTIG |
GTIG said that, for the first time, it had seen malware families "use Large Language Models (LLMs) during execution". Notice the split. The one that ran in the wild didn't rewrite itself. The one built to rewrite itself never ran.
Why is it on a social engineering site? Because the trick is aimed at a model. Give it a role, frame the request so it feels routine, and ask for something it shouldn't hand over. No person is fooled at any point.
See also AI-generated malware and prompt injection.
An experimental VBScript dropper, disclosed by Google in November 2025, that asks Gemini for antivirus-evasion code while it runs.
Not in the analysed sample. The self-update function is commented out. It only logs Gemini's replies to a file.
No. Google says it was in development or testing and doesn't show an ability to compromise a device or network.
Unknown. GTIG didn't attribute it and suggested, from file names, a financially motivated actor.
Social Engineering Examples. “PROMPTFLUX: the malware that asks Gemini to help it hide (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/gtig-promptflux-ai-self-obfuscating-malware-2025
consistent with GTIG's broader finding that threat actors are experimenting with commercially available LLM APIs rather than building bespoke AI, the author provisioned or obtained a Gemini API account and hard-coded a live API key into the malware so it could query the model unattended at runtime.
abuse of a commercial LLM API via a self-registered or stolen key sits mostly outside a downstream network defender's visibility, so the realistic control belongs to the AI provider. GTIG describes Google disabling the assets tied to this activity and strengthening Gemini's classifiers and the model itself so it refuses this kind of request. Rate-limiting and anomaly detection on repetitive obfuscation-style prompting is our own extension of that idea, not something GTIG recommends.
the author built a VBScript dropper wrapped around an embedded decoy installer, and named samples after ordinary software, for example "crypted_ScreenRec_webinstall." GTIG reads that naming as evidence of intent to distribute broadly to financially motivated ends. The naming is the whole of the evidence: no builder, no distribution infrastructure and no campaign was recovered.
no delivery of PROMPTFLUX was ever documented, so nothing here would have stopped this case. As general practice, application allowlisting and blocking unsigned or unexpected installers from non-corporate sources reduces the odds a stray installer reaches execution.
not documented. GTIG describes no detonation, no sandbox run and no infected host. Its development-phase assessment is drawn statically from the samples, "since some incomplete features are commented out and a mechanism exists to limit the malware's Gemini API calls." What follows is the behavior the code provides for, not a sequence anyone was observed running.
endpoint controls that treat VBScript execution from a freshly downloaded installer as suspicious by default, such as disabling the Windows Script Host for standard users or requiring signed scripts, would block a dropper of this shape before it runs.
the dropper is written to run from the Windows Startup folder. GTIG's summary table adds that the regenerated version is saved there too, but its technical narrative establishes that the function which would write a regenerated version is commented out, so no mutated payload was produced or persisted in the analyzed sample.
monitoring and alerting on unexpected writes to the Startup folder and other autorun locations is a long-standing persistence indicator that applies here regardless of how the payload was generated.
using the hard-coded API key, the dropper sends a POST request to the Gemini API asking for VBScript antivirus-evasion code and instructing the model to return code only. Every response is written to a log file in %TEMP%. This is the step that defines the case: the malware is trying to get a model to do the work an author would otherwise do.
network egress monitoring or allowlisting that flags scripting-engine processes (wscript.exe, cscript.exe) making outbound HTTPS calls to generative-AI API endpoints catches this class of malware at the moment it reaches out for AI-generated evasion code. This is the most transferable control in the case, and it is our reading rather than GTIG guidance.
a second variant carries a prompt asking Gemini to rewrite the malware's entire source file on an hourly basis, with the model instructed to act as an "expert VBScript obfuscator." GTIG describes the prompt, not an observed rewrite. Nothing in the report says a regenerated variant was ever produced, saved or run.
against a payload designed to mutate on a timer, static signature matching degrades and behavioral detection holds up, so flag the pattern of a script that rewrites and re-saves its own source file rather than fingerprinting any single generated variant.
the malware contains code to copy itself to removable drives and mapped network shares. No spread was observed.
standard removable-media and network-share hygiene, disabling autorun, restricting write access to shares, and endpoint detection tuned to mass file-copy behavior, limits how far malware of this shape spreads from one host.
the intended end state is a continuously mutating dropper resilient to signature-based detection. GTIG assessed that the samples had not reached it, that the activity was "in a development or testing phase, as opposed to being used in the wild," and disabled the associated Gemini assets.
this stage is an end state rather than an attacker action, so the defense is the cumulative effect of the controls above. In this case the effective control was not on any network: the AI provider identified the abuse of its own API and disabled the accounts behind it.
Browse by what this case has in common with others in the library.
ESET found PromptLock, ransomware that had a local AI model write its scripts at runtime. It turned out to be…
APT28's LAMEHUG malware asked an AI model on Hugging Face to write the spy commands it ran on Ukrainian government…
OpenAI says a Russian-speaking actor used throwaway ChatGPT accounts to build Windows malware, spread as a fake Crosshair-X gaming tool.…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
A Ukrainian-language "shared document" phishing wave used a fake reCAPTCHA "verify you are human" ClickFix page to trick victims into…
Argan's Fiscal 2024 cybersecurity disclosure described fraudulently induced outbound wire transfers in March 2023 and reported $2.7 million of loss,…
KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on…
Employees scanned a QR code in a fake Microsoft MFA-setup PDF and gave up passwords on a cloned login. How…
Imperva hid prompt injections behind whitespace in contact names, vCards and WhatsApp pins, making an OpenClaw agent run a script.…
A job candidate at Vidoc Security Lab hid behind a real-time face filter and refused to cover his face. What…
FraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it,…
A fraudster impersonating the company's chief executive tricked a Pivotal employee into emailing back affected employees' W-2 tax data.
Fraudsters faked WPP CEO Mark Read on WhatsApp and staged a Teams call with a cloned executive voice. The agency…
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
Employees scanned a QR code in a fake Microsoft MFA-setup PDF and gave up passwords on a cloned login. How…
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
Orlando police pulled about 200 fake QR stickers off downtown parking meters in June 2025. How to spot them: white…
Social Engineering Examples