Threat · curated 29 Aug 2026
The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
First reported paloaltonetworks.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
AI-enabled malware is no longer hypothetical — attackers are using LLMs to generate deployable downloader scripts in live phishing campaigns and are trending toward autonomous agentic execution, raising the volume and polish of malicious code defenders must detect.
Unit 42's "State of AI-Enabled Malware August 2026" surveys how adversaries have moved from AI-assisted brand abuse toward agentic execution, alongside Symantec's observations of real phishing campaigns delivering LLM-generated PowerShell downloaders. The observed campaigns used malicious .lnk files in password-protected ZIPs to trigger LLM-authored scripts that deployed payloads such as Rhadamanthys, CleanUpLoader (Broomstick/Oyster), NetSupport, ModiLoader, LokiBot, and Dunihi.
Summary
Unit 42 assembled a dataset of 405 unique AI-enabled malware hashes and measured real-world prevalence across Cortex XDR, WildFire, and VirusTotal telemetry. The central finding is that roughly 97% of these samples exist only in sandboxes, research repositories, and security-validation platforms; only 12 samples were observed on production endpoints, and every sample that attempted to reach a customer environment was detected and blocked.[0]
The 12 production samples span five families and distinct AI-integration or AI-themed delivery patterns: FunkSec ransomware (assessed as partially LLM-generated), a trojanized 'Recipe Lister' AI-app installer, the Oyster/CleanBoost backdoor delivered via a fake Dropbox installer, the Rhadamanthys stealer, and a COM-hijacking DLL impersonating 360 Total Security. All were caught by conventional mechanisms — sandbox detonation, behavioral analytics, code-signing anomaly detection, and entropy analysis — none requiring a novel approach.[0]
Symantec independently reported LLM-assisted phishing campaigns in which malicious .lnk files trigger LLM-generated PowerShell scripts that deploy payloads including Rhadamanthys and the CleanUpLoader (Oyster/Broomstick) backdoor, corroborating that attackers use AI to accelerate initial-access and delivery code rather than to evade execution-stage detection.[0][2]
Attack chain
- Initial access / delivery (LLM-assisted phishing): Phishing emails deliver password-protected ZIP archives containing malicious .lnk files that, when executed, run LLM-generated PowerShell scripts to download payloads such as Rhadamanthys and the Oyster/CleanUpLoader backdoor.[2]
- Trojanized AI-app lure: An NSIS installer masquerading as an AI/recipe application ('Recipe Lister'), signed with a since-revoked Global Tech Allies Ltd. certificate, extracts and runs a JavaScript backdoor from a temporary directory; a parallel installer forges a 'Dropbox, Inc.' signature and drops an AutoIt loader that side-loads the Oyster backdoor.[0]
- Persistence: A DLL impersonating 360 Total Security (360Util.dll) establishes persistence through COM object hijacking and was delivered alongside AI-branded lures.[0]
- Impact (ransomware): FunkSec ransomware variants disable Windows Defender via PowerShell and registry modifications, delete volume shadow copies, and change the desktop wallpaper to display a ransom note.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2025-01-01 to 2025-01-06 | Seven distinct FunkSec ransomware variants observed on production endpoints were compiled within a six-day window, indicating LLM-accelerated iteration.[0] |
| 2026-08-25 | Unit 42 published 'The State of AI-Enabled Malware August 2026,' summarizing analysis of 405 AI-enabled malware samples.[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-hash | 1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7 | SHA-256 of the trojanized RecipeLister NSIS installer observed across 50+ organizations.[0] |
| file-hash | 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd | SHA-256 of a FunkSec ransomware variant observed on production endpoints.[0] |
| file-hash | dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | 66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22 | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966 | SHA-256 of a FunkSec ransomware variant.[0] |
| file-hash | c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef | SHA-256 of the COM-hijacking DLL impersonating 360 Total Security (360Util.dll).[0] |
| file-hash | bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7 | SHA-256 of the Oyster backdoor/CleanBoost sample delivered via a forged Dropbox installer.[0] |
| file-hash | 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14 | SHA-256 of the Rhadamanthys stealer sample with active C2 communication.[0] |
| file-path | 360Util.dll | Malicious DLL impersonating a 360 Total Security component; PDB path references 360Util.pdb and it uses COM hijacking for persistence.[0] |
| file-path | redist.exe | .NET executable filename that delivers the Rhadamanthys information stealer.[0] |
| other | Code-signing certificate issued to Global Tech Allies Ltd. (revoked) | Certificate used to sign the trojanized RecipeLister installer; since revoked and a signal for code-signing anomaly hunting.[0] |
Key takeaways
- AI-enabled malware is real but overwhelmingly non-operational: about 97% of collected samples exist only in sandboxes, research repositories, and validation platforms, and only 12 of 405 reached production endpoints.[0]
- AI lowers the barrier to authoring malware and accelerates iteration (FunkSec produced seven variants in six days), but it has not helped authors evade defended environments — existing behavioral, sandbox, entropy, and signature-anomaly detections still catch the resulting binaries.[0]
- Current AI-enabled activity is opportunistic and broadly distributed with no significant sector or geographic targeting, and attackers primarily use AI to generate initial-access and delivery code, corroborated by Symantec's LLM-generated phishing chains.[0][2]
Defensive actions
- Rely on layered behavioral detection, cloud sandbox detonation, and endpoint analytics rather than seeking AI-specific detections.: Every AI-enabled sample that reached a customer environment was detected and blocked by the same mechanisms that catch conventional malware; the AI component changes how code is authored, not how it executes.[0]
- Flag code-signing anomalies such as uncommon signers across the fleet and near-maximum file entropy.: The trojanized RecipeLister installer initially suppressed static detection via a legitimate-looking signature, but behavioral analytics identified it through an uncommon signer and entropy of 0.999970 indicating packed/encrypted content, and a WildFire verdict triggered the block.[0]
- Treat AI-branded installers (impersonating popular AI apps or vendors like Dropbox/360 Total Security) as untrusted and inspect signature subject identity.: Attackers use AI brand recognition and forged/valid-looking signatures (e.g., a 'Dropbox, Inc.' Authenticode subject on an Oyster loader) as social-engineering delivery vectors.[0]
- Hunt for LLM-generated delivery chains: password-protected ZIP > .lnk > PowerShell downloader.: Symantec observed phishing emails whose attached .lnk files trigger LLM-generated PowerShell scripts that deploy Rhadamanthys and the Oyster/CleanUpLoader backdoor.[2]