World’s First AI-Powered Ransomware ‘PromptLock’ Emerges Using GPT-OSS-20B

Security researchers have uncovered PromptLock, a proof-of-concept ransomware strain that marks a significant evolution in malware design by integrating a local large language model (LLM) into its core attack chain.

Unlike traditional ransomware, which ships static, pre-compiled payloads, PromptLock dynamically generates cross-platform Lua scripts at runtime by querying a locally hosted OpenAI gpt-oss:20b model via the Ollama API.

While no live deployments have been spotted, this breakthrough demonstrates how threat actors could use on-the-fly AI code generation to craft more evasive and adaptable malware.

“PromptLock leverages Lua scripts generated from hard-coded prompts to enumerate the local filesystem, inspect target files, exfiltrate selected data, and perform encryption. These Lua scripts are cross-platform compatible, functioning on Windows, Linux, and macOS” ESET Research.

On-the-Fly Code Generation via Ollama API

PromptLock is implemented in Golang and distributed in both Windows and Linux variants on VirusTotal.

Cyber Security News reported that, Rather than embedding malicious logic directly, it carries hard-coded prompt templates that it submits as JSON payloads in HTTP POST requests to the local Ollama API endpoint (172.42.0.253:8443).

A simplified example request looks like:

jsonPOST /v1/generate HTTP/1.1
Host: 172.42.0.253:8443
Content-Type: application/json

{
  "model": "gpt-oss:20b",
  "prompt": "You are a Lua code generator. Write cross-platform Lua code to enumerate OS type, username, hostname, and working directory."
}

Upon receiving the request, the gpt-oss:20b model responds with tailored Lua scripts designed for specific malicious activities:

1. System Enumeration: Lua scripts that call os.execute() and io.popen() to collect OS version, user identity, and system hostnames on Windows, Linux, and macOS.
2. File System Inspection: Code leveraging lfs (LuaFileSystem) to traverse directories, detect files containing PII keywords, and log file paths.
3. Data Exfiltration & Encryption: Generated scripts that bundle files into AES-style containers before invoking the SPECK 128-bit block cipher for encryption.

The selection of Lua is strategic: its lightweight interpreter enables seamless embedding within Go binaries, ensuring the generated scripts run transparently across multiple operating systems.

Indicators and Future Implications

Although PromptLock remains a developmental PoC—with, for example, an unimplemented data-destruction function defined but never called—it already demonstrates key indicators of compromise (IoCs):

• Malware Family: Filecoder.PromptLock.A
• Sample SHA1 Hashes:
  1. 24BF7B72F54AA5B93C6681B4F69E579A47D7C102
  2. AD223FE2BB4563446AEE5227357BBFDC8ADA3797
  3. BB8FB75285BCD151132A3287F2786D4D91DA58B8

Intriguingly, one of the prompt templates contains a placeholder Bitcoin address linked to Satoshi Nakamoto, likely a red herring or developer signature.

ESET researchers emphasize the importance of public disclosure to prepare defenders for an era of dynamic, AI-driven threats, cautioning that as local LLMs grow more capable, malware may shift from static payloads to personalized, on-device code generation.

Organizations should monitor anomalous local API traffic (e.g., unexplained POSTs to 172.42.0.253:8443) and employ behavior-based detection techniques to identify AI-assisted ransomware in future attack vectors.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates