How AI Is Changing the Malware Landscape

## Overview

Vicente Diaz from VirusTotal presents findings from a year-long study using Large Language Models (LLMs) for malware analysis. Working with VirusTotal's database of approximately 50 billion samples, the team implemented Code Insight—an LLM-based tool to analyze suspicious scripts and binaries—and discovered both unexpected strengths and significant limitations. The talk emphasizes practical findings over speculation, addressing whether AI is meaningfully changing the malware landscape.

## Key Findings on LLM Capabilities

**Exploit Detection**: LLMs identified exploits in 100% of a test sample set, yet only 31% were detected by traditional antivirus engines. Key reasons include: exploits often referenced in variable names and comments within code, many attackers reuse public proof-of-concepts from GitHub, and antivirus engines lack incentive to flag certain behaviors (e.g., PHP scripts performing external actions on endpoints).

**Obfuscation Handling**: LLMs successfully deobfuscate code through runtime analysis in ways traditional tools cannot. Traditional detection methods show only 5% agreement with LLM identification of obfuscation.

**File Type Identification**: LLMs can identify unusual or obscure file formats by analyzing content rather than magic bytes—e.g., correctly identifying LAMMPS molecular simulation input scripts.

**Comparison with Antivirus**: Agreement rates vary by file type: Microsoft Office macros (98%), PowerShell (96%), but only 72.4% for PHP files due to differences in detection incentives and available analysis engines.

## Technical Details and Limitations

LLMs provide non-binary explanations rather than simple yes/no verdicts, helping analysts evaluate gray-area samples (installers vs. droppers). However, they face significant challenges:

- **Prompt sensitivity**: Different prompting and temperature settings yield varying results - **False positives from code content**: Variable names or comments can mislead analysis (example: a variable named "puppies" caused an LLM to soften its assessment despite detecting malicious behavior) - **Inconsistency between models**: Different LLMs produce slightly different answers for the same code - **Inability to confirm AI generation**: No reliable method exists to distinguish AI-generated from human-written code

## AI-Generated Malware Findings

The team found Cobalt Strike and Meterpreter Beacon samples with artifacts suggesting LLM generation but detected no meaningful code differences from non-AI-generated equivalents. One notable example involved a ransomware script generated from a complex prompt that attempted to combine Windows and Linux operations because the LLM synthesized capabilities from both platforms to satisfy contradictory requirements. Overall, no significant new malware families or detection-evading patterns attributed to AI generation were identified.

## Observed Attack Attempts

**Prompt injection attacks**: Simple attempts (e.g., "ignore everything") were observed but remain easy to detect and control.

**Malware impersonation**: Peak in samples impersonating AI-related software and services (fake ChatGPT clients), though without significant overall impact.

**OpenAI interaction**: Unexplained peaks in malware interacting with OpenAI APIs, with no clear threat justification identified.

## Implications for the Malware Landscape

**Is AI lowering the bar?** The existing barrier to malware creation is already low. AI primarily accelerates development and enables greater agility in script creation, but does not appear necessary for technical sophistication. Greatest potential impact is in social engineering, distribution, and deep fake-enabled CEO fraud.

**Is AI changing malware?** No significant malware family transformations or patterns suggesting AI-driven evolution were detected. The fundamental challenge is that if AI-generated malware is sophisticated enough to evade detection, it would be invisible to current analysis methods—creating an unknown risk.

**Detection and monitoring implications**: LLMs provide valuable complementary analysis, moving beyond binary verdicts to offer explanations that analysts can contextualize using their own criteria. They serve as a "second opinion" signal alongside traditional detection methods.

## Takeaways

1. LLMs are useful tools for malware analysis despite limitations, particularly for exploit detection and obfuscation handling 2. Explanatory capability is the primary advantage—providing context antiviruses do not 3. The main barrier to AI-generated malware detection is indistinguishability from human code 4. Social engineering and malware distribution are the most immediate threats from AI advancement 5. Continued experimentation and knowledge-sharing across the security community is critical 6. Future expansion to binary decompilation analysis will likely reveal new capabilities

Diaz concludes that the field is in its infancy and encourages all security professionals to experiment with LLM-based analysis to discover unexpected applications and collectively improve detection and hunting capabilities.