Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Reddit NetSec

Check Point Research

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This research explores the challenges posed by LLM-enabled malware, which can generate malicious logic at runtime. The study identifies characteristics of such malware, including embedded API keys and specific prompt structures. Notable cases like PromptLock and APT28's LameHug are examined. The researchers developed hunting strategies based on API key detection and prompt analysis, leading to the discovery of new samples, including 'MalTerminal'. The implications for defenders are discussed, highlighting both the adaptability and potential brittleness of LLM-enabled malware. The research also uncovered various offensive tools leveraging LLMs for operational capabilities.

This threat concerns the emergence of LLM-enabled malware, a novel class of malicious software that leverages large language models (LLMs) to dynamically generate malicious logic at runtime. Unlike traditional malware with static payloads, LLM-enabled malware can adapt its behavior by generating code or commands on the fly based on embedded prompts and API keys. The research highlights specific malware families and campaigns such as PromptLock and APT28's LameHug, which utilize these techniques. These malware samples embed API keys within their code to interact with external LLM services, enabling them to craft sophisticated attack logic dynamically. The study also uncovered new samples like 'MalTerminal' that demonstrate the operational capabilities of LLM-powered offensive tools. The malware uses prompt engineering to control the LLM's output, effectively turning prompts into executable code segments. This approach increases malware adaptability and complexity, making detection and mitigation more challenging. The research team developed hunting strategies focusing on detecting embedded API keys and analyzing prompt structures to identify these threats. The findings underscore both the potential brittleness of LLM-enabled malware—due to reliance on external APIs and prompt design—and their adaptability, which can evade traditional signature-based defenses. The threat also involves tactics and techniques mapped to MITRE ATT&CK IDs such as T1071 (Application Layer Protocol), T1219 (Remote Access Software), T1059 (Command and Scripting Interpreter), T1083 (File and Directory Discovery), T1027 (Obfuscated Files or Information), T1486 (Data Encrypted for Impact), T1573 (Encrypted Channel), and T1588 (Obtain Capabilities), indicating a broad and sophisticated attack surface.

Detailed information about Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware. Get real-time updates, technical details, and mitigation strategi

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware

Title	Severity	Type	Source	Date

Threats Tagged 'api keys'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'api keys'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility