Palo Alto Networks’ Unit 42 team analyzed 405 malware samples tied to AI in some way, from ransomware partly written with the help of LLMs to installers that simply borrowed the name of a popular AI app.
The researchers found that roughly 97% of the samples in the dataset never left a sandbox, research repository, or internal testing environment to reach a real target.
Unit 42 cross-referenced the 405 file hashes against endpoint telemetry, network sessions forwarded for sandbox analysis, and internal alert records generated whenever a sample actually ran. Only 12 hashes surfaced on live endpoints, while a somewhat larger group (15-20 hashes) appeared in network sandbox traffic. Every one of the 12 samples detected on protected endpoints triggered a security alert.
The samples that never reached production fall into three groups. The largest is proof-of-concept code built to demonstrate a technique: configured to target only local or private networks, filled with debug output no real attacker would leave behind, and uploaded once by a research lab or university.
A second group comes from organizations testing their own defenses against previously reported AI malware, identifiable by repeated uploads of the same file from the same source in a short window. A third group uses AI branding purely as bait, dressing up an ordinary payload as installers for well-known AI products with no actual AI functionality behind them.
The 12 samples that did reach live endpoints spanned five malware families across three countries, with no concentration in any particular industry or region.
The most common family was FunkSec, a ransomware strain that multiple researchers have linked to LLM assistance. Internal project file names embedded in the analyzed samples show a developer cycling through several names for the same ransomware, a pace Unit 42 said is more consistent with prompt-driven generation than a traditional development cycle.
The single most widely encountered sample was an installer posing as a recipe-finding app called Recipe Lister. It carried a digital signature and quietly launched a backdoor once installed. The file spread across more than 50 organizations, generating roughly 6,500 endpoint records and about 9,600 alerts. Its signature initially avoided suspicion, but an unusual signer combined with heavily packed file contents led to its detection.
Another malware strain, the Oyster backdoor, posed as a Dropbox installer, carrying a signature that listed Dropbox as the publisher. Unit 42 said attackers are increasingly turning to AI tools to generate this kind of delivery code, making it faster and cheaper to establish an initial foothold.
A separate Windows executable delivered the Rhadamanthys information stealer with active command-and-control communication, which earlier reporting tied to an AI-assisted infection chain.
The fifth sample impersonated a component of the Chinese security product 360 Total Security and used a persistence technique known as COM hijacking. Unit 42 included it in the dataset because it appeared in campaigns delivered alongside AI-branded lures, even though the sample’s own behavior did not depend on AI.
Unit 42 said existing defenses caught every sample using the same methods that catch conventional malware: sandbox detonation, behavior-based detection, anomalies in digital signatures, and measurements of how heavily a file is packed or encrypted. None of the AI-linked samples required a new detection method to be identified and blocked.
The findings point to AI’s current role in malware as a way to speed up how quickly attackers can build and vary their tools, not a way to make those tools harder to catch.
Related: Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation
Related: Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund
Related: Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini
