Researchers have identified PROMPTFLUX, an experimental malware dropper that reportedly uses Google’s Gemini API to rewrite parts of its own code about once every hour.
The technique shows how attackers could use generative AI to create many changing versions of the same malicious program, making traditional security detection harder.
Polymorphic malware is not new. Older variants often changed encryption layers, file names, or small parts of their code to avoid antivirus signatures.
PROMPTFLUX represents a more advanced approach because it uses an AI model as an automated code-generation service.
Rather than relying only on a fixed set of changes prepared by its developer, the malware can request fresh and obfuscated code while it runs.
Google threat researchers disclosed the experimental threat in late 2025. PROMPTFLUX was designed to contact Gemini and obtain rewritten versions of its code.
In some observed cases, samples generated more than 70 distinct variants in less than four hours. Each variant could perform a similar malicious task while looking different at the code level.
PROMPTFLUX Gemini Malware Rewrites
This creates a serious challenge for defenders. Most signature-based products look for known file hashes, strings, byte patterns, or recognizable code structures.
If malware produces a different file every time, those indicators can quickly become outdated. A security tool may block one sample but fail to identify the next rewritten version.
PROMPTFLUX is part of a growing set of threats exploring AI-assisted malware development. Another sample, PROMPTSTEAL, reportedly used an AI model to generate short Windows commands for collecting documents.
Other proof-of-concept or reported families, including PromptLock and BlackMamba, have also demonstrated how large language models can support code generation, command creation, and payload modification.
The key issue is speed. Human malware developers traditionally need time to modify code, test it, package it, and distribute a new campaign.
AI services could reduce that effort by generating variations automatically. An attacker may ask a model to rename functions, change logic, alter obfuscation, rebuild scripts, or create new command sequences.
This can move malware closer to metamorphic behavior. A classic polymorphic threat may retain a stable malicious core hidden behind different encryption.
A more advanced AI-assisted threat could continually replace code blocks, leaving fewer consistent elements for defenders to match.
However, changing code does not make malware harmless or unstoppable. Even highly variable payloads still need to execute, access memory, create processes, contact command-and-control infrastructure, steal files, or encrypt data.
These actions can expose them through endpoint telemetry, identity controls, network monitoring, sandboxing, and behavioral analysis, morphisec said. Organizations should therefore avoid depending on a single detection method.
Hash and signature checks remain useful for known threats, but they should be combined with application control, least privilege, multi-factor authentication, endpoint detection and response, attack-surface reduction rules, and strong monitoring of suspicious scripting activity.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
