AI Malware Is Here. But Most of It Has Yet to Reach the Real World
AI is already being used to create malware. But most samples remain in research and testing environments
Illustration: Julio Lopez via pexels.com
AI-enabled malware is real, but most of it has yet to reach real-world environments.
A new analysis by Unit 42, the threat research team at Palo Alto Networks, examined 405 malware samples incorporating AI, from code generated with the help of large language models to more advanced AI-enabled capabilities.
The researchers’ central finding was that “the AI malware space is currently overwhelmingly composed of proof-of-concept code, security validation testing and researcher submissions that have never reached a production environment.”
Only 12 of the 405 samples appeared on endpoints protected by Cortex XDR. Approximately 97% were found only in research repositories, sandbox environments and security-testing platforms. Palo Alto Networks said its products detected and blocked every sample that attempted to reach a customer environment.
Many of the samples were research projects designed to demonstrate AI-related attack techniques. Others were submitted by security teams testing their defenses. Some used AI branding to make conventional malware appear to be legitimate AI software.
The samples that did reach real environments included several different types of malware.
FunkSec ransomware was the most represented. Seven versions appeared on production endpoints, all compiled within six days. Unit 42 says the development pace suggests that AI-assisted coding may be helping attackers produce new variants faster.
Another sample disguised itself as a recipe-finding application called Recipe Lister. It appeared across more than 50 organizations and generated thousands of security alerts, but was blocked before it could successfully execute on protected endpoints.
Other samples borrowed the names and appearance of familiar software, including Dropbox and 360 Total Security.
Despite their AI components, the malware did not require new detection methods. Existing defenses, including behavioral analysis and sandboxing, detected the samples.
“The AI component does not evade detection. It changes how the code is authored, not how it executes,” Unit 42 wrote.
The researchers do identify one potential advantage for attackers: AI can make malicious code faster and easier to produce. But, as Unit 42 notes, “creating a sample and successfully deploying it against a defended environment are different problems.”
For now, the vast majority of AI-enabled malware analyzed by Unit 42 remains in research, testing and experimentation rather than production environments.