Recent Malware Campaigns Use AI to Generate Commands and Search Files
Summary
Recent campaigns used AI prompts in malware to generate commands, search files, or attempt destructive actions. The article says these approaches often failed and discusses possible motives and defensive implications.
Key points
- LameHug prompted an LLM to generate commands to collect system information and copy documents; it encoded its requests in base64.
- Malicious code inserted into the Amazon Q Developer Extension attempted to direct an AI agent to delete local files and cloud resources; the command did not successfully run in customer environments, according to AWS.
- Malicious Nx package versions used prompts with Claude, Gemini, and Q to search for sensitive files and credentials; some prompts tried to bypass LLM guardrails.
- PromptLock, later identified as an academic project, used a local LLM to interpret files and generate a personalized ransom note.
- The author says generated code varied and appeared to fail in several cases, while remote AI service requests could create audit trails or enable providers to intervene.
- The article recommends ensuring detections work with non-deterministically generated code and controlling AI tools so malicious actors cannot operate them.
Article Details
- Event Type
- Multiple reported incidents and campaigns in which malware or compromised software payloads invoked AI/LLMs to generate or execute commands, including the LameHug malware, the Amazon Q Developer Extension compromise, the s1ngularity supply-chain attack, and the PromptLock academic project.
- Impact
- Reported impacts included collection of system and document information by LameHug, attempted destructive actions against files and accessible cloud resources through the compromised Amazon Q Developer Extension (the AWS security bulletin said the command did not run successfully in customer environments), and theft of secret credentials from environments using malicious Nx package versions in the s1ngularity supply-chain attack. PromptLock was later found to be part of an academic project.
MITRE ATT&CK
T1005 · Data from Local SystemLameHug prompted an LLM to generate commands to gather system information and names of documents; s1ngularity payloads searched local files.T1083 · File and Directory DiscoveryThe s1ngularity payload prompted AI tools to search filesystem paths for files matching specified patterns.T1195.002 · Compromise Software Supply ChainMalicious versions of the Nx build system package were published to the npm registry, resulting in a supply-chain attack.T1552 · Unsecured CredentialsThe s1ngularity supply-chain attack stole secret credentials from affected environments.
Malware
LAMEHUGOn July 17, 2025 Ukraine’s CERT reported information about malware called LameHug. This malware sends prompts to HuggingFace asking for commands to collect information about the system that the malware runs on, andPromptLockThe PromptLock sample also used a local LLM model which would have avoided the auditing and control that the remote models would have had in potentially stopping one of the other attacks. If they had tuned the model,
Vendors
Products
Amazon Q Developer ExtensionAmazon Q Developer Extension compromiseAWS CodeBuildGitHub Actions to gain access to the repository and used a previously unknown technique against Amazon CodeBuild. They also attempted to evade discovery by not executing the malicious code in testing environments.ClaudeThe payload attempted to use Claude, Gemini, and Q with those prompts. As you can see in the prompts above, multiple versions of the payload were seen which tried to use prompt engineering to bypass the guardrails ofGeminiThe payload attempted to use Claude, Gemini, and Q with those prompts. As you can see in the prompts above, multiple versions of the payload were seen which tried to use prompt engineering to bypass the guardrails ofHuggingFace2025 Ukraine’s CERT reported information about malware called LameHug. This malware sends prompts to HuggingFace asking for commands to collect information about the system that the malware runs on, and commands toNxOn August 26, 2025, multiple malicious versions of the widely used Nx build system package were published to the npm registry in an incident we reported on as s1ngularity. This resulted in a supply chain attack againstQAmazon Q Developer Extension compromiseS3instructing the AI agent to delete all the non-system files on the disk, along with cloud resources such as S3 buckets it has access to. According to the AWS security bulletin for this incident, the command was not