Case malterminal-gpt4-malwareAI-assisted malwareWorldwide
SentinelLABS finds MalTerminal, GPT-4-driven malware generator likely predating Nov 2023
Hunting for embedded API keys, SentinelLABS found MalTerminal.exe and loaders that ask GPT-4 to generate ransomware or a reverse shell at runtime via an endpoint deprecated in November 2023; no in-the-wild use found.
LowAttack using AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 22, 2025
- Location
- Worldwide
- Target
- None confirmed; proof-of-concept or red team tooling
- Severity
- Low
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Hunting for embedded API keys, SentinelLABS found MalTerminal.exe and loaders that ask GPT-4 to generate ransomware or a reverse shell at runtime via an endpoint deprecated in November 2023; no in-the-wild use found.
Impact: No victims identified; a VirusTotal retrohunt found over 7,000 samples with 6,000 unique API keys, plus offensive LLM tools such as vulnerability injectors and WormGPT copycats.
Who triggered it
Actor: Unknown
Attribution: SentinelLABS presented the finding at LABScon 2025; authorship unknown, possibly a researcher or red team.
Motive: Unknown
How it happened
Attack vector: Python-compiled Windows executable prompting the OpenAI chat completions API to write malicious code on demand
Root cause: Cloud LLM APIs allow malware to defer malicious logic generation to runtime, leaving little static signature
Timeline
- Deprecated OpenAI endpoint suggests sample written before this date
- Findings presented at LABScon 2025
- Coverage and abridged write-up published
Response
SentinelLABS published hunting methods based on embedded keys and prompt structures.
Current status: Resolved
Sources (open in a new tab)
- SentinelLABS sentinelone.com
- Security Affairs securityaffairs.com
- The Hacker News thehackernews.com
Cite this case
SentinelLABS finds MalTerminal, GPT-4-driven malware generator likely predating Nov 2023. AI Threat Watch, case malterminal-gpt4-malware, Sep 22, 2025. https://aithreat.io/cases/malterminal-gpt4-malware/
Permanent link: https://aithreat.io/cases/malterminal-gpt4-malware/