Malware Now Uses AI During Execution to Mutate and Collect Data, Google Warns

Google’s Threat Intelligence Group has documented malware that uses AI during execution to mutate, self-modify and data‑collect, signalling a step towards more autonomous threats. According to Google Threat Intelligence Group, examples seen in the wild include PromptFlux, a VBScript dropper that can rewrite its code and persist in the Startup folder, and FruitShell, a PowerShell-based reverse shell with hardcoded AI prompts to bypass AI-powered security.

Other highlighted families are PromptSteal, a Python data miner that queries an LLM to generate Windows commands for collecting system data, and QuietVault, a JavaScript credential stealer that searches for tokens using AI tools on the host. The researchers note that some threats are still experimental—PromptLock being cited as an on‑the‑rise proof‑of‑concept—but the trend is toward more autonomous and adaptive malware, with social‑engineering prompts used to bypass guardrails.

Nation-state actors linked to China, Iran and North Korea were also said to have continued using Google’s Gemini to enhance reconnaissance and data exfiltration.