Google flags PROMPTFLUX malware that uses Gemini AI for dynamic code rewriting

The Google Threat Intelligence Group (GTIG) has uncovered a novel malware strain dubbed PROMPTFLUX that integrates directly with Google’s Gemini AI model to regenerate its own source code over time. Written in VBScript, PROMPTFLUX reaches out to the Gemini API via a hard-coded key and sends machine-parsable prompts that instruct the model to produce obfuscated code aimed at bypassing static detection. Among the variants observed, one cycle prompts Gemini hourly to rewrite the entire script, effectively a self-modifying “thinking robot” component designed for persistence and stealth. While currently seen in testing or early stage (no full network compromise documented), experts warn that such AI-driven malware sets a new bar for evasion and could well be the precursor to more advanced adaptive threats.

Source: thehackernews.com