Case unit42-gpt4-gated-sliver-dropperAI-assisted malwareWorldwide
Unit 42: Go dropper asks GPT-4 whether to deploy Sliver based on host telemetry
Unit 42 analysed a Golang dropper that sends host telemetry to GPT-4 posing as an OPSEC AI and only runs its Sliver payload if the model returns execute true, plus a .NET stealer whose GPT-3.5 calls were mostly theatre.
MediumAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 19, 2026
- Location
- Worldwide
- Target
- Windows hosts of unknown victims
- Severity
- Medium
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Unit 42 analysed a Golang dropper that sends host telemetry to GPT-4 posing as an OPSEC AI and only runs its Sliver payload if the model returns execute true, plus a .NET stealer whose GPT-3.5 calls were mostly theatre.
Impact: No campaign or victims identified; demonstrates AI-gated execution in real samples.
Who triggered it
Actor: Unknown
Attribution: Unit 42 could not determine whether the samples were AI-written; dropper first flagged publicly by MalwareHunterTeam.
Motive: Unknown
How it happened
Attack vector: Dropper with embedded OpenAI API usage gating payload execution on an LLM verdict
Root cause: Public LLM APIs provide malware a remote decision engine that evades static analysis
Timeline
- MalwareHunterTeam flags the GPT-4-gated Sliver dropper on X
- Unit 42 publishes analysis of AI-written and AI-controlled malware samples
Response
Unit 42 shared hashes and detections.
Current status: Under investigation
Sources (open in a new tab)
- Unit 42 unit42.paloaltonetworks.com
- BleepingComputer bleepingcomputer.com
Cite this case
Unit 42: Go dropper asks GPT-4 whether to deploy Sliver based on host telemetry. AI Threat Watch, case unit42-gpt4-gated-sliver-dropper, Mar 19, 2026. https://aithreat.io/cases/unit42-gpt4-gated-sliver-dropper/
Permanent link: https://aithreat.io/cases/unit42-gpt4-gated-sliver-dropper/