PromptLock: A New AI-Powered Ransomware Strain Creates Unique, Elusive Scripts

The cybersecurity company ESET has released a report detailing its latest discovery: an artificial intelligence–driven ransomware strain codenamed PromptLock. The ransomware leverages OpenAI’s open-source GPT-OSS-20B model to dynamically generate scripts in real time for the theft of files and sensitive information.

Written in Golang, PromptLock utilises the Ollama API to locally deploy the GPT-OSS model, which in turn produces malicious Lua scripts on demand that enumerate the local file system, identify target files, exfiltrate selected data, and carry out encryption, with cross‑platform compatibility across Windows NT, Linux and macOS.

Notably, PromptLock appears to still be in the proof‑of‑concept stage and has not yet been deployed in real‑world attacks; instead of downloading the full model, it establishes a proxy via the infected network and connects to an Ollama API server running GPT‑OSS. According to ESET, the real concern lies in the AI‑generated Lua scripts, which are inherently unique due to variations in outputs, complicating detection by traditional signature‑based methods.