Bản viết lại dựa trên nguồn: https://www.securityweek.com/ai-speeds-up-malware-development-not-its-success-rate-analysis/
AI Speeds Up Malware Development, Not Its Success Rate: Analysis – SecurityWeek SECURITYWEEK NETWORK: Cybersecurity News Webcasts Virtual Events Podcast ICS: ICS Cybersecurity Conference Malware & Threats Cyberwarfare Cybercrime Data Breaches Fraud & Identity Theft Nation-State Ransomware Vulnerabilities Security Operations Threat Intelligence Incident Response Tracking & Law Enforcement Security Architecture Application Security Cloud Security Endpoint Security Identity & Access IoT Security Mobile & Wireless Network Security Risk Management Cyber Insurance Data Protection Privacy & Compliance Supply Chain Security CISO Strategy Cyber Insurance CISO Conversations CISO Forum ICS/OT Industrial Cybersecurity ICS Cybersecurity Conference Funding/M&A Cybersecurity Funding M&A Tracker Cyber AI Cybersecurity News Webcasts Virtual Events Podcast ICS Cybersecurity Conference Connect with us Hi, what are you looking for? SecurityWeek Malware & Threats Cyberwarfare Cybercrime Data Breaches Fraud & Identity Theft Nation-State Ransomware Vulnerabilities Security Operations Threat Intelligence Incident Response Tracking & Law Enforcement Security Architecture Application Security Cloud Security Endpoint Security Identity & Access IoT Security Mobile & Wireless Network Security Risk Management Cyber Insurance Data Protection Privacy & Compliance Supply Chain Security CISO Strategy Cyber Insurance CISO Conversations CISO Forum ICS/OT Industrial Cybersecurity ICS Cybersecurity Conference Funding/M&A Cybersecurity Funding M&A Tracker Cyber AI Artificial Intelligence AI Speeds Up Malware Development, Not Its Success Rate: Analysis Palo Alto Networks Unit 42 analyzed 405 AI-linked malware samples and found only 12 reached production endpoints. By Eduard Kovacs | August 26, 2026 (11:23 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Palo Alto Networks’ Unit 42 team analyzed 405 malware samples tied to AI in some way, from ransomware partly written with the help of LLMs to installers that simply borrowed the name of a popular AI app. The researchers found that roughly 97% of the samples in the dataset never left a sandbox, research repository, or internal testing environment to reach a real target. Unit 42 cross-referenced the 405 file hashes against endpoint telemetry, network sessions forwarded for sandbox analysis, and internal alert records generated whenever a sample actually ran. Only 12 hashes surfaced on live endpoints, while a somewhat larger group (15-20 hashes) appeared in network sandbox traffic. Every one of the 12 samples detected on protected endpoints triggered a security alert. The samples that never reached production fall into three groups. The largest is proof-of-concept code built to demonstrate a technique: configured to target only local or private networks, filled with debug output no real attacker would leave behind, and uploaded once by a research lab or university. A second group comes from organizations testing their own defenses against previously reported AI malware, identifiable by repeated uploads of the same file from the same source in a short window. A third group uses AI branding purely as bait, dressing up an ordinary payload as installers for well-known AI products with no actual AI functionality behind them. The 12 samples that did reach live endpoints spanned five malware families across three countries, with no concentration in any particular industry or region. Advertisement. Scroll to continue reading. The most common family was FunkSec, a ransomware strain that multiple researchers have linked to LLM assistance. Internal project file names embedded in the analyzed samples show a developer cycling through several names for the same ransomware, a pace Unit 42 said is more consistent with prompt-driven generation than a traditional development cycle. The single most widely encountered sample was an installer posing as a recipe-finding app called Recipe Lister. It carried a digital signature and quietly launched a backdoor once installed. The file spread across more than 50 organizations, generating roughly 6,500 endpoint records and about 9,600 alerts. Its signature initially avoided suspicion, but an unusual signer combined with heavily packed file contents led to its detection. Another malware strain, the Oyster backdoor, posed as a Dropbox installer, carrying a signature that listed Dropbox as the publisher. Unit 42 said attackers are increasingly turning to AI tools to generate this kind of delivery code, making it faster and cheaper to establish an initial foothold. A separate Windows executable delivered the Rhadamanthys information stealer with active command-and-control communication, which earlier reporting tied to an AI-assisted infection chain. The fifth sample impersonated a component of the Chinese security product 360 Total Security and used a persistence technique known as COM hijacking. Unit 42 included it in the dataset because it appeared in campaigns delivered alongside AI-branded lures, even though the sample’s own behavior did not depend on AI. Unit 42 said existing defenses caught every sample using the same methods that catch conventional malware: sandbox detonation, behavior-based detection, anomalies in digital signatures, and measurements of how heavily a file is packed or encrypted. None of the AI-linked samples required a new detection method to be identified and blocked. The findings point to AI’s current role in malware as a way to speed up how quickly attackers can build and vary their tools, not a way to make those tools harder to catch. Related: Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation Related: Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund Related: Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Australia Arrests 2 Alleged TeamPCP HackersOpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face HackCyberattack Causes Global Disruption at Boston ScientificUS Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure AttacksRecent Citrix NetScaler Vulnerability Exploited in the WildAdobe and Nvidia Patch Dozens of VulnerabilitiesCISA: Over 100 Internet-Exposed Water Systems Targeted in July CyberattacksChrome 152 Patches Over 300 Vulnerabilities Latest News Hasbro Data Breach Exposed Employee Personal InformationIn Other News: Log4j RCE Scare, Minimus Shutdown, Iranian Hacker SanctionsATF Confirms Cyber Incident After Ransomware Group Claims AttackOpenAI Agents Exploited Linux Kernel Flaw on Company’s Own SystemsTech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense PledgeThink You’ve Eliminated Chinese AI? Check the Model’s Lineage, Cisco SaysPaperCut Releases Emergency Patch for Exploited Zero-DayTrump Order Aims to Block Foreign Backdoors in US Power Grid Gear Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveSocial engineering protection company Doppel has promoted Alyssa Smrekar to Chief Marketing Officer.Naveen Bhateja has been appointed Chief People Officer at HackerOne.The Department of War has appointed Sonu Shankar as Principal Deputy Chief Information Officer.More People On The MoveExpert Insights The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Hired for One Job, Judged on Another: The CISO’s Real Problem The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. (Sravish Sridhar) Rethinking Application Security for the AI Era As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk. (Joshua Goldfarb) Flipboard Reddit Whatsapp Whatsapp Email Popular Topics Cybersecurity News Industrial Cybersecurity Security Community Virtual Cybersecurity Events Webcast Library CISO Forum AI Risk Summit ICS Cybersecurity Conference Cybersecurity Newsletters Stay Intouch Cyber Weapon Discussion Group RSS Feed Security Intelligence Group Follow SecurityWeek on LinkedIn About SecurityWeek Advertising Event Sponsorships Writing Opportunities Feedback/Contact Us Privacy Policy News Tips Got a confidential news tip? We want to hear from you. Submit Tip Advertising Reach a large audience of enterprise cybersecurity professionals Contact Us Daily Briefing Newsletter Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox. Privacy Policy Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time. Close