MalTerminal: New GPT-4-Powered Malware That Writes Its Own Ransomware

MalTerminal is described as GPT-4-powered malware that dynamically generates ransomware code or reverse shells at runtime, marking a notable shift in how malicious logic can be created. According to SentinelLABS, these LLM-enabled threats offload functionality to AI systems rather than carrying fully embedded payloads, complicating static signature detection.

The malware is a Python-based executable that queries GPT-4 to produce the requested capability, with the package including MalTerminal.exe, testAPI.py scripts, and a defensive tool named FalconShield. Researchers found that MalTerminal prompts users to choose between “Ransomware” or “Reverse Shell” options, then leverages GPT-4’s code-generation capabilities to satisfy the selected task and adapt to environmental conditions.

The discovery notes a deprecated OpenAI chat completions API endpoint from November 2023, suggesting MalTerminal predates other documented LLM-enabled malware; the analysis also covered over 7,000 samples containing more than 6,000 unique API keys found via retrohunting across VirusTotal. This work underscores evolving threats where malicious logic can be generated at runtime rather than being embedded in advance.