AI-driven malware evades detection and uses blockchains for persistence
Researchers including Google and Cisco Talos discovered malware that uses AI models to rewrite code, evade detection, and make autonomous attack decisions. The malware also hides instructions on public blockchains, creating persistent infrastructure difficult to take down without disrupting legitimate cryptocurrency services.
What happened
Google discovered malware that uses AI models like Gemini to rewrite code and evade detection. Researchers found that unrestricted AI models are being used to hide malware instructions on public blockchains, creating communication channels that persist even after servers are taken offline.
Reported impact
Hackers are using AI-guided malware that can autonomously select post-compromise actions, making blockchain-based malware infrastructure accessible to less experienced attackers. The use of public blockchains for malware distribution is difficult to block without disrupting legitimate cryptocurrency services worldwide.
Index analysis
The incidents demonstrate AI systems being repurposed for autonomous malicious decision-making in attacks. Malware leverages commercial AI model outputs to determine next steps, and AI capabilities enable code generation and obfuscation that complicates malware detection and analysis.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.