Google’s Threat Intelligence Group found experimental malware called PROMPTFLUX that could ask Gemini to rewrite its own code. One version was designed to do that every hour. Why would malware keep rewriting itself? To make it harder to recognize.
Security software can look for known patterns in malicious code. If that code keeps changing, the malware becomes a moving target. That does not automatically make it invisible to current security tools, but it can make some types of detection more difficult.
There is an important reality check here. PROMPTFLUX was still being developed when Google found it. Researchers had yet to see it successfully compromise a victim’s device or network, and Google disabled assets connected to the activity.
What caught my attention is what came next. Google has since documented AI being used by malware during live attacks. It has also uncovered an Android backdoor that can use AI to understand what is happening on a phone and help decide what to do next. That tells us where this could be heading. So let’s break down how AI-powered malware works and what you can do to protect yourself.
AN AI CYBERATTACK COULD TURN OFF AMERICA’S LIGHTS BEFORE WASHINGTON EVEN UNDERSTANDS WHY
NEW! 🩺 Free CyberGuy LIVE class: Get Better Healthcare With AI Saturday, September 26 at 11 a.m. ET / 8 a.m. PT
Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare smarter questions for your doctor. No technical experience is needed.
Save your free spot at CyberGuyLive.com
PROMPTFLUX was a VBScript-based malware project that Google discovered in June 2025. Its most interesting component was called the “Thinking Robot.” The malware could contact Gemini and request new obfuscation techniques designed to make its code harder for security software to recognize.
Google later found multiple PROMPTFLUX variations. One included instructions telling Gemini to rewrite the malware’s entire source code every hour while preserving the pieces needed for it to continue working. Think about what that means from the defender’s side. Security software may identify one version of malicious code. Then the program can generate a different-looking version while continuing to pursue the same goal. That creates a moving target.
Google described PROMPTFLUX as an early example of “just-in-time” AI being built directly into malware. Instead of relying entirely on functions written ahead of time, malware can ask an AI model for help while it runs.
No, and this is where I want to be careful. You may hear AI malware described as something that can simply change its appearance and walk right past antivirus protection. The reality has more layers. Signature detection still plays a role in cybersecurity. Security software can recognize the digital fingerprints of known malware and block them quickly.
However, antivirus protection does much more than compare a file with a list of known threats. Microsoft Defender Antivirus, for example, uses real-time monitoring, behavioral analysis and heuristic protection. It also uses cloud-delivered protection and machine learning to help identify new threats that may not match a known malware signature.
That means changing the code does not automatically make malware invisible. A security tool may still notice suspicious behavior once the malware starts doing something dangerous. PROMPTFLUX is concerning because it can make one form of detection harder. That does not mean every layer of modern antivirus suddenly stops working.
PROMPTFLUX was experimental. PROMPTSTEAL crossed an important line. Google identified the Russian government-backed group APT28 using PROMPTSTEAL against targets in Ukraine. Google says this was its first observation of malware querying a large language model while deployed in live operations.
PROMPTSTEAL takes a different approach from PROMPTFLUX. Instead of asking AI to rewrite itself, it queries the Qwen2.5-Coder-32B-Instruct model through Hugging Face. The model generates Windows commands that PROMPTSTEAL can execute.
Those commands can gather information about a computer and copy documents from folders including Documents, Downloads and Desktop. The malware then sends collected information back to infrastructure controlled by the attacker. That is a significant change. The AI model becomes part of what the malware does after it starts running.
Then came PROMPTSPY. Google detailed the Android backdoor in May 2026 after it was initially identified by ESET. PROMPTSPY contains an AI-powered module called GeminiAutomationAgent. It can send information about what appears on an infected Android device to Gemini and use the response to help navigate the phone’s interface.
In other words, the malware can use AI to understand part of what is happening on the screen and determine how to interact with it. Google found that PROMPTSPY could also make itself harder to remove. When a victim tried to uninstall it, the malware could place an invisible overlay over the uninstall button so taps would appear to do nothing. There is some good news for Android users.
Google says it took action against the actor behind the malware. It also said no apps containing PROMPTSPY were found on Google Play at the time of its May report. Known versions are detected by Google Play Protect, which is enabled by default on Android devices with Google Play Services. Still, PROMPTSPY gives us a much clearer picture of where this technology could go. Malware can begin reacting to the device it finds instead of relying only on instructions written before the attack starts.
HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER
Google’s newest report makes the larger trend harder to ignore. On Sept. 8, 2026, Google Threat Intelligence Group said it had seen attackers move from basic AI prompting toward agentic AI workflows and AI-enabled automation. That means AI can start taking on larger pieces of an operation with less human involvement.
One example really jumped out at me. Google says a suspected financially motivated attacker compromised a company’s cloud infrastructure. The attacker then used an AI coding chatbot and agent instructions to plan, build and execute a mass credential-harvesting campaign in less than six hours. The system could manage vulnerability scanning and troubleshoot problems while the attack was underway. Google says thousands of third-party credentials were compromised.
Google has also seen attackers experimenting with automated reconnaissance and frameworks designed to manage harvested credentials. However, there is another important reality check. Google says it has yet to observe threat actors deploying fully autonomous exploit pipelines against targets in the wild. We have not reached the point where an AI system independently launches every part of a cyberattack without people involved. The amount of work AI can take off an attacker’s hands keeps growing, though.
AI arrives on top of an already huge malware problem. Independent security institute AV-TEST says it registers more than 450,000 new malicious programs and potentially unwanted applications every day. That number does not mean 450,000 completely different attacks are hitting people every day. Malware samples can include different versions and variations of existing threats.
Still, the volume shows why security companies cannot depend on recognizing every malicious file by its appearance alone. Meanwhile, the financial damage tied to cyber-enabled crime continues to climb. The FBI says Americans reported nearly $21 billion in cyber-enabled crime losses during 2025, up 26% from the year before. Those losses cover many kinds of online crime and cannot be attributed to AI malware. However, they show what criminals already stand to gain when technology makes attacks easier to run.
You do not need to understand how an AI model rewrites VBScript to protect yourself. The best defense still comes from making it harder for malware to reach your device and harder for it to succeed if something slips through.
Look for strong antivirus software with real-time protection and behavioral detection. That becomes especially useful when malicious software changes enough that a traditional signature may not recognize it immediately. The right protection can watch what a program does after it starts running. Suspicious file changes or attempts to alter sensitive system settings can trigger another layer of detection. If you are comparing protection, see our guide to what to look for in antivirus software without the jargon. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
Security software cannot help as much if its strongest protections have been disabled. On Windows, Microsoft says Defender’s behavior monitoring is enabled by default. Cloud-delivered protection also helps detect new and emerging threats. If a website, pop-up or random tutorial tells you to disable antivirus protection so something will install, stop. Do not turn off security protections to make a questionable download work.
Keep your operating system and browser current. Do the same for software you use regularly. Attackers often look for people running software with vulnerabilities that already have patches available. Automatic updates can close those openings without forcing you to track every security bulletin yourself.
CHINA-LINKED HACKERS INFILTRATED US GOVERNMENT NETWORKS BEFORE FBI TAKEDOWN
This has become one of the most important malware warnings I can give you. Attackers increasingly use fake CAPTCHA pages and bogus error messages to tell victims to open Windows Run, PowerShell, Command Prompt or Terminal. The page then asks them to paste a command. Do not do it. A legitimate CAPTCHA should never require you to run a command on your computer. We recently reported that more than 5,400 compromised websites were being used in one campaign built around this trick. See how thousands of hacked sites can trick you into installing malware.
Security warnings can feel annoying when you are trying to download something quickly. Do not automatically click past them. Microsoft Defender SmartScreen, for example, can check websites and downloads for signs of phishing or malicious software. If your browser blocks a file or tells you a site looks dangerous, investigate before continuing. A website should never pressure you to weaken your computer’s security so you can proceed.
PROMPTSPY gives Android users a good reason to pay attention to where apps come from. Google says Play Protect checks apps for harmful behavior. It also scans apps installed from outside Google Play. Keep Play Protect enabled. Be especially cautious with sideloaded apps from websites, messages or unfamiliar app stores. The same thinking applies to browser extensions. An extension can gain significant access to what happens inside your browser, so install only what you need from a source you trust.
A password manager helps you create unique passwords for your accounts. It can also give you a useful phishing warning. If a saved password normally fills automatically and suddenly does not, stop and check the website address before typing the password yourself. Use multifactor authentication where available. Better yet, use a passkey when a service supports one. Keep in mind that some information-stealing malware can target browser cookies or authenticated sessions. MFA still helps, but no login protection gives you permission to ignore malware on the device itself.
Back up anything you would hate to lose. That could include family photos and financial records. Keep other irreplaceable files covered too. A cloud backup can help. An external drive that you disconnect when you are finished backing up can give you another recovery option. A backup will not stop malware from stealing data, but it can make ransomware or destructive malware much less devastating.
Watch for unfamiliar programs and unexplained security alerts. Pay attention if your antivirus suddenly turns itself off or your browser starts behaving strangely. If you think a computer may be infected, disconnect it from the internet and run a trusted security scan. For a PC, you can follow our guide on what to do if you think your PC has a virus. If passwords or financial information may have been exposed, use a different trusted device to change important passwords. Then sign out of active sessions where the service allows it. Check your financial accounts for activity you do not recognize. Act quickly if something looks wrong.
PROMPTFLUX caught my attention because of what it says about the direction malware is taking. For years, attackers have found ways to change malicious code and make detection harder. AI gives them another tool for doing that while the malware is running. I would not take that to mean antivirus protection suddenly became obsolete. Strong security software already looks beyond a simple malware fingerprint. Behavior monitoring and cloud-based analysis can help catch threats that have never been seen before.
What concerns me more is how quickly the technology is progressing. PROMPTFLUX was experimental. PROMPTSTEAL appeared in live operations. PROMPTSPY showed how AI could help malware interpret an Android interface. Now Google is seeing attackers use agentic AI to automate larger portions of an attack. For me, the lesson is pretty straightforward. Do not depend on one security feature to save you. Keep good protection running, take security warnings seriously and make it difficult for malicious software to get onto your devices in the first place. If something does get through, reacting quickly can limit how far the damage goes.
As malware becomes capable of changing its code and making more decisions with AI, do you think security companies can stay ahead, or are we heading toward a point where it becomes much harder to know whether our devices are truly safe? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
