Executive Summary

To assess the impact of AI-enabled malware, we collected and analyzed over 400 malware samples that integrate AI in some capacity, from brand impersonation and large language model (LLM)-generated code to agentic execution loops. Our central finding was that the AI malware space is currently overwhelmingly composed of proof-of-concept code, security validation testing and researcher submissions that have never reached a production environment.

Of the 405 samples in our dataset, only 12 appeared in our telemetry on Cortex XDR-protected endpoints, and a small subset was forwarded through Next-Generation Firewalls to WildFire for analysis. Palo Alto Networks products detected and blocked every sample that attempted to reach a customer environment.

These numbers tell a story that sits between two poles in the current discourse. AI-enabled malware is real. However, the volume of genuine operational activity remains a fraction of what public sample repositories suggest. Approximately 97% of the samples we examined exist only in sandboxes and on VirusTotal.

For defenders, the practical takeaway is straightforward. Existing behavioral detection, cloud-based sandboxing and endpoint analytics catch these threats using the same mechanisms that stop conventional malware. The AI component does not evade detection. It changes how the code is authored, not how it executes.

Palo Alto Networks customers are better protected against the threats discussed in this article through the following products and services, which detected these AI-enabled malware threats out of the box:

• Advanced WildFire
• Cortex XDR and XSIAM

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

The Dataset

Our starting dataset consisted of 405 unique SHA-256 hashes collected from WildFire analysis reports, VirusTotal Intelligence and published open-source intelligence (OSINT) research.

The collection criteria were broad. We included any sample where AI integration was either a functional component of the malware, a feature of its delivery mechanism or part of its branding. This intentionally inclusive approach captured everything from LLM-powered ransomware agents to cryptocurrency miners that simply used “ChatGPT” in their filename.

We queried this dataset across multiple telemetry sources to measure real-world prevalence:

• Endpoint presence: Cortex XDR agent telemetry from non-test tenants (December 2024–June 2025)
• Network visibility: WildFire session data from samples forwarded by Next-Generation Firewalls and Cortex XDR agents (June 2024–June 2025)
• Alert generation: Cortex XDR alert records for samples that triggered detection logic on endpoints
• Sandbox verdicts: WildFire analysis results with malware classification

Table 1 summarizes the results of this dataset.

Telemetry Source	Samples Queried	Samples Discovered	Prevalence in Production
Cortex XDR endpoints	405	12	3.0%
WildFire sessions	405	~15–20 unique hashes	~4%
Cortex XDR alerts generated	12	12	100%

Table 1. Telemetry coverage across the AI malware dataset.

The disparity between the 405-sample dataset and the 12 samples observed in production environments is the most important number in this analysis. Approximately 97% of AI-enabled malware samples exist only in research repositories, sandbox environments and security validation platforms. We found no evidence that they reached a customer endpoint or traversed a customer firewall.

The following sections examine the characteristics of the dataset.

What the Other 97% Looks Like

The samples that never appeared in production telemetry fall into three categories:

• Proof-of-concept and research code
• Security validation and testing
• AI-themed brand abuse

Proof-of-Concept and Research Code

The largest category consists of proof-of-concept implementations published to demonstrate a technique. These include:

• LLM-powered ransomware frameworks with hard-coded test parameters (such as ransom addresses pointing to the Bitcoin Genesis Block, which cannot receive recoverable payments)
• AI-assisted reconnaissance scripts designed for conference demonstrations
• Modular attack frameworks built to test specific AI integration patterns rather than to compromise real targets

Many of these samples share common characteristics:

• They target localhost or private IP address ranges in their configuration
• They contain verbose debug logging that no operational threat actor would leave enabled
• Their submission histories show a single upload from a security research organization or academic institution

Additionally, we found many of these samples in file paths that indicated malware analysis or research. They contained terms such as research, mal or analysis in their directory paths.

Security Validation and Testing

A second category comprises samples submitted by breach-and-attack simulation (BAS) platforms and internal security teams. These appear in WildFire and on VirusTotal because organizations deliberately test their detection capabilities against publicly reported AI malware samples.

The submission patterns are distinctive. They include multiple uploads of the same hash from the same organization within a short time window, often during business hours in a single time zone. They frequently come from IP addresses associated with known security testing infrastructure.

AI-Themed Brand Abuse

A third category uses AI branding without meaningful AI integration. Filenames reference popular AI companies or other AI products, but the payload is conventional malware wrapped in an installer that mimics an AI application.

The AI branding is a social engineering tactic, not a technical capability. These samples are real threats to the people who download them, but they do not represent a new category of AI-enabled attack.

The 3% Found on Endpoints

Twelve samples from the dataset appeared on Cortex XDR-protected endpoints across organizations in three countries. They span five distinct malware families, each representing a different pattern of AI integration or AI-themed delivery. These five families are:

• FunkSec ransomware
• A trojanized AI application
• The Oyster backdoor
• The Rhadamanthys stealer
• A COM hijacking DLL

FunkSec Ransomware

The most represented family in our endpoint data is FunkSec, a ransomware strain that multiple researchers have assessed as partially generated with LLM assistance. Seven distinct variants appeared across production endpoints, compiled between Jan. 1–6, 2025. The variants share a common Rust codebase and use similar evasion techniques:

• Disabling Windows Defender through PowerShell and registry modifications
• Deleting volume shadow copies
• Changing the desktop wallpaper to display a ransom note

The PDB paths embedded in the binaries reveal an active development cycle. Variants use project names including:

• Dev.pdb
• Funksec.pdb
• Darkzone.pdb
• Darkfunk.pdb

This is consistent with a developer iterating on the same codebase under multiple working names. Seven distinct builds in six days is a pace that suggests LLM-assisted development, where generating a new variant is closer to a prompt generation rather than a software development task.

WildFire classified all seven variants as malware. Cortex XDR generated alerts for every variant that executed on an endpoint.

Trojanized AI Application

The most widely encountered sample in the dataset is an NSIS installer that masquerades as a recipe-finding application called Recipe Lister. The binary is signed with a code-signing certificate issued to Global Tech Allies Ltd. — a certificate that has since been revoked. When executed, it extracts and runs a JavaScript backdoor from a temporary directory.

This sample generated the highest volume of telemetry in our dataset. It appeared across more than 50 organizations and generated over 6,500 endpoint profile records and 9,600 XDR alerts during the observation window. The alert data confirms that Cortex XDR blocked the binary across these environments through a combination of local analysis, behavioral protection and WildFire cloud verdicts. No execution succeeded on a protected endpoint.

The detection dynamics around this sample illustrate how layered defense handles AI-themed threats:

• The code signature initially suppresses static detection, as the file appears legitimately signed
• Behavioral analytics identify the threat through two secondary signals:
  • The signer is uncommon across the organization's fleet
  • The file entropy is near-maximum (0.999970), indicating packed or encrypted content
• The WildFire cloud verdict, which arrives after the file is forwarded for sandbox analysis, provides the definitive classification and triggers the block action

Oyster Backdoor

One sample masquerades as a Dropbox installer and carries an Authenticode signature whose subject identity reads Dropbox, Inc. To the victim, this appears to be verified, publisher-signed software. In reality, the installer drops an AutoIt loader that side-loads the Oyster (aka CleanBoost) backdoor. The signed file is not Dropbox software, and the signature lends it false legitimacy.

Attackers are using AI tools to quickly generate the malicious code required for the initial access and delivery phases of the attack, lowering the barrier to entry and speeding up the deployment of loaders like this NSIS installer.

Rhadamanthys Stealer

A .NET executable named redist.exe delivers the Rhadamanthys information stealer with active command-and-control communication. According to previous reporting, this sample was part of an AI-enabled infection chain that ultimately delivered this sample of Rhadamanthys stealer.

COM Hijacking DLL

A DLL masquerading as a component of 360 Total Security named 360Util.dll implements persistence through COM object hijacking. The PDB path references 360Util.pdb, and the file metadata impersonates the Chinese-language product name. We included this sample in the dataset because it was delivered alongside AI-branded lures in campaigns we observed.

Conclusion

The gap between the volume of AI malware samples in public repositories and the volume observed in production environments reflects the current state of AI-enabled threats. AI lowers the barrier to creating malware, and the number of samples in our dataset confirms that many people are experimenting with the technique. But creating a sample and successfully deploying it against a defended environment are different problems, and malware authors have not to date succeeded at using AI to solve the second one.

The samples that did reach production environments were detected by the same mechanisms that catch conventional malware:

• Sandbox detonation
• Behavioral analytics
• Code-signing anomaly detection
• Entropy analysis

None of the AI-enabled samples in our dataset required a novel detection approach. The AI component influenced how the malware was written, but the resulting binary still exhibits the same behavioral indicators that existing detection logic targets.

This does not mean we can dismiss AI-enabled threats:

• The development velocity visible in FunkSec's PDB paths suggests that LLM-assisted coding accelerates the iteration cycle for ransomware development
• The trojanized AI application campaign demonstrates that AI brand recognition is an effective social engineering vector, with the sample reaching more than 50 organizations
• The presence of legitimate code signatures on multiple samples shows that the delivery sophistication of AI-themed malware matches that of conventional threats

Telemetry data does not reveal statistically significant targeting patterns across the samples. The encounters span three countries and industries with no concentration in any single sector or geography. This is consistent with opportunistic operations rather than targeted campaigns directed at specific organizations or verticals.

The absence of targeting patterns is itself informative. AI-enabled malware, at this stage of adoption, follows the same distribution model as most offensive cyber activity. Threat actors are integrating AI capabilities into tools that they’ve deployed broadly rather than reserving them for operations against specific high-value targets.

When evaluating AI in the current malware landscape, it should not be categorized as mere hype or altogether dismissed. AI-enabled malware is a real and growing category, but our current defensive frameworks detect and block AI-enabled malware regardless of the role that use of AI played in its development. Organizations that maintain strong defense in depth are well positioned to detect these threats as they evolve.

Palo Alto Networks customers are better protected from the threats discussed above through the following products, which detected these AI-enabled malware threats out of the box:

• The Advanced WildFire machine-learning models and analysis techniques identify indicators shared in this research.
• Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware and prevent the execution of unknown malware using Behavioral Threat Protection and machine learning based on the Local Analysis module.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107
• South Korea: +82.080.467.8774

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Samples

Table 2 lists the samples assessed as genuine threat actor activity.

SHA256 hash	Family
1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7	Trojanized application (RecipeLister)
5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd	FunkSec ransomware
dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac	FunkSec ransomware
66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd	FunkSec ransomware
c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c	FunkSec ransomware
e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22	FunkSec ransomware
b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb	FunkSec ransomware
20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d	FunkSec ransomware
dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966	FunkSec ransomware
c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef	COM hijacking DLL
bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7	Oyster backdoor/CleanBoost
4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14	Rhadamanthys stealer

Table 2. Samples observed on production endpoints.

Additional Resources

Analyzing the Current State of AI Use in Malware — Palo Alto Networks, Unit 42