Unit 42: AI Speeds Malware Creation
Unit 42 researchers analysed 405 malware samples linked to AI and found that 97% never reached production, while only 12 samples appeared on live endpoints, all of which triggered alerts.
Unit 42, Palo Alto Networks’ threat-intelligence unit, examined 405 malware samples that incorporated artificial-intelligence elements, from ransomware written with large-language-model (LLM) assistance to installers that merely adopted the name of a popular AI app.
The analysis revealed that roughly 97% of the samples never left a sandbox, research repository, or internal testing environment to reach a real target. Only 12 hashes appeared on live endpoints, and a slightly larger group-between 15 and 20 hashes-showed up in network traffic that was forwarded for sandbox analysis. Every one of the 12 samples detected on protected endpoints triggered a security alert.
Sample Distribution
The samples that never reached production fall into three groups. The largest group consists of proof-of-concept code built to demonstrate a technique. These are configured to target only local or private networks, contain debug output that a real attacker would not leave behind, and are uploaded once by a research lab or university. The second group comes from organizations testing their own defenses against previously reported AI malware; these are identifiable by repeated uploads of the same file from the same source in a short window. The third group uses AI branding purely as bait, dressing up an ordinary payload as installers for well-known AI products with no actual AI functionality behind them.
| Location | Samples |
|---|---|
| Live endpoints | 12 |
| Network sandbox traffic | 15-20 |
| Total analysed | 405 |
Notable Malware Families
The 12 samples that did reach live endpoints spanned five malware families across three countries, with no concentration in any particular industry or region. The most common family was FunkSec, a ransomware strain that multiple researchers have linked to LLM assistance. Internal project file names embedded in the analysed samples show a developer cycling through several names for the same ransomware, a pace that Unit 42 said is more consistent with prompt-driven generation than a traditional development cycle.
The single most widely encountered sample was an installer posing as a recipe-finding app called Recipe Lister. It carried a digital signature and quietly launched a backdoor once installed. The file spread across more than 50 organizations, generating roughly 6,500 endpoint records and about 9,600 alerts. Its signature initially avoided suspicion, but an unusual signer combined with heavily packed file contents led to its detection.
Another malware strain, the Oyster backdoor, posed as a Dropbox installer, carrying a signature that listed Dropbox as the publisher. Unit 42 said attackers are increasingly turning to AI tools to generate this kind of delivery code, making it faster and cheaper to establish an initial foothold.
A separate Windows executable delivered the Rhadamanthys information stealer with active command-and-control communication, which earlier reporting tied to an AI-assisted infection chain.
The fifth sample impersonated a component of the Chinese security product 360 Total Security and used a persistence technique known as COM hijacking. Unit 42 included it in the dataset because it appeared in campaigns delivered alongside AI-branded lures, even though the sample’s own behavior did not depend on AI.
Detection and Defense
Unit 42 said existing defenses caught every sample using the same methods that catch conventional malware: sandbox detonation, behavior-based detection, anomalies in digital signatures, and measurements of how heavily a file is packed or encrypted. None of the AI-linked samples required a new detection method to be identified and blocked.
The findings point to AI’s current role in malware as a way to speed up how quickly attackers can build and vary their tools, not a way to make those tools harder to catch.
The analysis was conducted by the Unit 42 team, which can be found on the squad page of Palo Alto Networks’ threat-intelligence portal. For detailed statistics on the sample distribution, see the stats section. The proof-of-concept code samples are listed in the fixtures repository.
The last sample in the dataset was a backdoor that impersonated a component of the Chinese security product 360 Total Security, using COM hijacking for persistence.
