Analysis of over 400 AI-integrated malware samples reveals that approximately 97% exist only in research repositories and sandboxes, never reaching production environments. Of 405 samples examined, only 12 appeared on protected endpoints across three countries, spanning five malware families including FunkSec ransomware, trojanized AI applications, Oyster backdoor, Rhadamanthys stealer, and COM hijacking DLLs. All samples were successfully detected and blocked by existing behavioral detection, cloud-based sandboxing and endpoint analytics. The AI component influences code authorship rather than execution patterns, enabling faster development cycles as evidenced by FunkSec's seven variants compiled within six days. Findings indicate AI lowers barriers to malware creation but has not yet enabled evasion of established defensive mechanisms, with opportunistic rather than targeted distribution patterns observed.

Indicators of Compromise

• hash: 4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14
• hash: bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7
• hash: c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef
• hash: 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd
• hash: c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c
• hash: 20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d
• hash: 66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd
• hash: b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb
• hash: dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac
• hash: dd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966
• hash: e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22
• hash: 1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7