AI Threat Watch

Case gtig-promptfluxAI-assisted malwareWorldwide

Google flags PROMPTFLUX and other malware that call Gemini at runtime

Google's threat team reported experimental malware such as PROMPTFLUX that asks Gemini to rewrite its own VBScript for evasion, plus state use of LLM-enabled tools like PROMPTSTEAL.

MediumAttack using AIStatus: ContainedVerified case file

Open in the interactive mapCite this case

Reported
Nov 5, 2025
Location
Worldwide
Target
Windows systems
Severity
Medium
Triggered by
Unknown developer (PROMPTFLUX); APT28 (Russian GRU-linked) for PROMPTSTEAL
Actor type
State-sponsored
Reported loss
None reported
CVE
None

What happened

Google's threat team reported experimental malware such as PROMPTFLUX that asks Gemini to rewrite its own VBScript for evasion, plus state use of LLM-enabled tools like PROMPTSTEAL.

Impact: PROMPTFLUX assessed as experimental with no confirmed victims; PROMPTSTEAL collected system data and documents from Ukrainian targets. No financial loss reported.

Who triggered it

Actor: Unknown developer (PROMPTFLUX); APT28 (Russian GRU-linked) for PROMPTSTEAL

Attribution: PROMPTFLUX not attributed by Google (naming consistent with financially motivated actors); PROMPTSTEAL attributed to APT28 by GTIG and CERT-UA

Motive: Evasion research and testing (PROMPTFLUX); espionage and data theft against Ukraine (PROMPTSTEAL)

How it happened

Attack vector: Malware embedding Gemini API calls to regenerate obfuscated VBScript at runtime; PROMPTSTEAL used a Hugging Face-hosted Qwen model with stolen API tokens to generate commands

Root cause: Public LLM APIs reachable from malware with stolen or free keys; just-in-time code generation lets malware offload logic to an external model to evade static detection

Timeline

  1. CERT-UA documents LAMEHUG/PROMPTSTEAL used by APT28 against Ukrainian targets
  2. GTIG publishes AI Threat Tracker describing PROMPTFLUX, PROMPTSTEAL and other LLM-calling malware
  3. Google says it disabled API keys and projects associated with the activity

Response

Google disabled associated Gemini API keys and projects and added classifier protections; researchers including Marcus Hutchins questioned PROMPTFLUX's practical significance.

Current status: Contained

Sources (open in a new tab)

Cite this case

Google flags PROMPTFLUX and other malware that call Gemini at runtime. AI Threat Watch, case gtig-promptflux, Nov 5, 2025. https://aithreat.io/cases/gtig-promptflux/

Permanent link: https://aithreat.io/cases/gtig-promptflux/

This case file in other languages: EnglishFrançaisEspañolالعربية中文