A New Era of Threats: Lessons from Agentic AI Malware - Candid Wuest

A New Era of Threats: Lessons from Agentic AI Malware

Speakers: Candid Wuest, Antivirus Veteran

Conference: Disobey

YouTube: https://www.youtube.com/watch?v=RDhdxmwX17g

Overview

In his compelling talk at Disobey, Candid Wuest, a seasoned veteran of the antivirus industry, meticulously dissects the pervasive hype surrounding "AI malware" and rigorously separates it from the current reality of cyber threats. Titled "A New Era of Threats: Lessons from Agentic AI Malware," Wuest's presentation serves as a critical examination of how artificial intelligence is genuinely being leveraged by cybercriminals today, and more importantly, what the future of truly autonomous, AI-powered malicious software might entail. He challenges common misconceptions, such as exaggerated statistics claiming AI's dominance in ransomware, by drawing upon over two decades of experience in analyzing thousands of malware samples.

The core of Wuest's discussion revolves around defining what constitutes "AI malware" beyond simple AI-generated code, focusing instead on agentic systems that dynamically adapt and make autonomous decisions during runtime. This distinction is crucial for understanding the evolving threat landscape. The talk is highly relevant for security professionals, red teamers, and anyone interested in the practical implications of AI in cybersecurity, as it provides a grounded perspective on an often-sensationalized topic. Wuest's insights underscore the need for defenders to focus on robust, behavior-based detection mechanisms as AI continues to accelerate and automate various stages of the attack kill chain, rather than being distracted by the more fantastical claims of fully sentient, self-propagating AI threats.

Background

▶ Watch: Debunking AI malware hype and reality check (0:00)

Candid Wuest initiated his talk by establishing his extensive credentials, having worked in the antivirus and malware industry for over 25 years. His experience includes generating signatures that protect hundreds of millions of systems globally, from critical infrastructure like nuclear power stations and submarines to the International Space Station (ISS), where his product notably detected the first-ever malware in outer space—a World of Warcraft gaming trojan. This deep background in malware analysis provides a unique vantage point from which to assess the current state and future trajectory of AI in cyberattacks.

Wuest first contextualized the current applications of AI by cybercriminals, noting that while true "AI malware" is still nascent, AI is already widely employed in various stages of the attack chain. These include the creation of deepfakes for business email compromise (BEC) and CEO fraud, where voice or video clones are used to deceive victims, leading to significant financial losses. Social engineering has also seen substantial AI integration, with bots scraping social media platforms like LinkedIn to craft highly targeted phishing emails. Furthermore, vulnerability research has been significantly accelerated by AI, with large language models (LLMs) capable of identifying hundreds of vulnerabilities, including zero-days, in open-source projects like OpenSSL, putting immense pressure on maintainers. General automation of various tasks and overlooked threats like prompt injections and model poisoning round out the current landscape of AI abuse.

The critical distinction Wuest introduces is between AI-generated malware and AI-powered malware. The former refers to script kiddies using LLMs to write malicious code, which often fails due to guardrails or produces simplistic, easily detectable binaries (e.g., ransomware with symmetric keys embedded). The latter, which is the focus of his talk, refers to agentic AI malware that utilizes AI during runtime to dynamically adapt, make autonomous decisions, and evade detection. He draws parallels to polymorphic and metamorphic malware from the 1990s, which adapted their code to bypass static signatures, but emphasizes that AI introduces a new dimension of behavioral adaptation. Prior work in this domain primarily involved code obfuscation; AI-powered malware aims for dynamic, intelligent adaptation of attack methods and payloads.

Key Findings

▶ Watch: Current practical AI uses by cybercriminals today (2:50)

Candid Wuest's presentation systematically debunks much of the sensationalized narrative surrounding AI malware, while simultaneously highlighting the genuine, albeit evolving, threats. His primary finding is that the vast majority of what is currently labeled "AI malware" in media reports is either AI-generated code (often of poor quality and easily detectable) or merely the application of AI tools for cybercrime, rather than within the malware itself. He stresses that true agentic AI malware, which dynamically adapts its behavior during runtime, is still in its early evolutionary stages, representing an "evolution" rather than a "revolution."

Despite the hype, Wuest demonstrates that current examples of AI-powered malware, such as Lamehawk (attributed to APT28) and Singularity, exhibit significant limitations. Lamehawk, for instance, used the Quento 255 model to generate system reconnaissance commands but was easily thwarted by the blocking of its stolen API keys and its use of a low "temperature" setting (0.1) that resulted in highly predictable, non-polymorphic outputs. Singularity, while attempting to hijack local AI command-line interfaces, required re-infection for updates, indicating a lack of true autonomy. Even academic projects like Prompt Lock (Ransomemer 3.0), though conceptually interesting, faced practical hurdles like limited token memory and reliance on specific interpreters (Lua).

However, Wuest underscores that AI's undeniable power lies in automating and accelerating attacks. It significantly lowers the barrier to entry for novice attackers by providing code generation and reconnaissance capabilities. More critically, AI is proving highly effective in vulnerability research, rapidly identifying zero-days, thereby shrinking the window for defenders to patch and respond. The speaker's own proof-of-concept (PoC) demonstrated that an AI orchestrator could dynamically generate and adapt persistence and data exfiltration techniques to bypass different EDR solutions, showcasing the potential for sophisticated, adaptive attacks that can evade static and even some behavioral detections.

Crucially, Wuest concludes that while AI-powered malware is possible, its current unreliability, resource intensiveness, and dependence on external AI models make it less appealing for sophisticated attackers compared to established methods like "living off the land" or simply exploiting stolen credentials. Nevertheless, the continuous improvement of AI models, especially with the advent of smaller, more efficient local models, suggests that the capabilities of agentic malware will only grow, demanding a proactive and adaptive defense strategy focused on robust behavior-based detection and prompt response.

Technical Deep Dive

▶ Watch: Why AI-generated malware isn't the real threat (4:40)

The technical core of Wuest's talk thoroughly dissects the mechanisms and limitations of AI in malware, distinguishing between simple AI-generated code and sophisticated agentic AI malware.

AI-Generated Malware: The Script Kiddie Approach

Wuest begins by illustrating how rudimentary AI-generated malware often fails. LLMs, despite guardrails, can be prompted to generate ransomware. However, early attempts often yield functionally flawed code, such as ransomware with the decryption key embedded symmetrically within the binary itself—a critical flaw for any serious operation. Moreover, such generated code, even if functional, is typically detected by any decent EDR (Endpoint Detection and Response) product due to its observable behaviors (e.g., file encryption). The Voidlink example, where a Cobalt Strike-like framework was generated, highlighted that even "successful" AI-assisted malware development often requires developer expertise and can still be compromised by operational security failures (e.g., open directory listings of prompts).

Polymorphic vs. AI-Powered Adaptation

Wuest revisits the concept of polymorphic and metamorphic malware from the 1990s, which changed their code structure to evade static signatures. He argues that AI-powered malware elevates this by dynamically changing its behavior at runtime. Instead of merely re-encrypting or adding garbage loops, an AI-powered loader might query an LLM for new code snippets to steal browser passwords, for example. While this introduces dynamic behavior, Wuest points out a critical flaw: the "static stub" or initial loader remains constant, and the reliance on an external API key creates a single point of failure.

Case Study: Lamehawk (APT28)

A notable example of AI in malware is Lamehawk, attributed to the Russian APT28 group. This info-stealer used the Quento 255 model to dynamically generate Windows command-line commands for reconnaissance (e.g., net user, net group, netstat). The attackers used approximately 300 stolen API keys, which were eventually blocked by Hugging Face, rendering the malware useless. Wuest performed an experiment, running the Lamehawk prompt 100 times, and found that due to a low temperature setting (0.1), the LLM consistently generated identical commands. This demonstrated that while AI was used, its application was not truly polymorphic or adaptive in a sophisticated sense; a simple copy-paste would have achieved the same result with less overhead.

Case Study: Singularity

Singularity emerged from a supply chain attack involving an npm package. It attempted to hijack local AI command-line interfaces (e.g., Claude, Gemini) by posing as an "authorized pentester" to search for sensitive files. However, this method proved unreliable, requiring multiple prompt iterations and, critically, new versions of the malware to be deployed for adaptations, indicating a lack of true agentic learning or real-time modification.

The Vision of True Agentic AI Malware

Wuest outlined the aspirational characteristics of truly powerful AI malware:

• Autonomous Decisions: The ability to set a high-level goal (e.g., "get rich") and autonomously plan, orchestrate, and execute subtasks.
• Self-Learning and Adapting: Evolving techniques based on successes and failures, although learning from failure is challenging when an agent is deleted by EDR.
• Contextual Decisions: Identifying the specific EDR solution present and deploying a tailored bypass (e.g., Bring Your Own Vulnerable Driver - BYOVD).
• Mimicking User Behavior: While theoretically possible, Wuest notes this requires extensive monitoring and data exfiltration, making it very noisy and easily detectable.

Wuest's Proof of Concept: "Loop" and Agent Teams

To demonstrate the potential, Wuest developed a PoC called "Loop," a PowerShell-based, fileless malware using a reasoning AI model for orchestration. It aimed for metamorphic prompts, generating new prompts in different languages for the same task to evade detection.

The "Loop" process involved:

1. Infection: (Assumed, not demonstrated)
2. Goal Retrieval: Fetching the main objective from a C2 or decrypting it from the binary.
3. LLM Query: Asking the LLM for code to achieve the first sub-task.
4. Execution & Feedback: Running the generated code, capturing results, and feeding them back to the AI for error correction or the next step.
5. Exfiltration: Using the LLM itself to summarize data from a URL and embed it in a GET parameter for C2.

Expanding on "Loop," Wuest introduced the concept of Agent Teams or Swarms. This architecture involves an AI Orchestrator preloaded with the cyberattack kill chain and MITRE ATT&CK framework, along with APT reports. This orchestrator plans subtasks and monitors sub-agents. If a sub-agent is killed, the orchestrator can learn and adapt. Sub-agents handle specific tasks like researching persistence methods, decrypting browser passwords, or finding target files. Wuest suggested using multiple LLMs, such as Claude for code generation and Gemini for verifying the results, enhancing reliability. An execution agent then generates, runs, and error-corrects commands.

Adaptive Obfuscation Demo

Wuest presented a compelling demonstration of adaptive obfuscation against different EDRs:

• Microsoft Defender: The AI generated a PowerShell script using classical string concatenation (e.g., breaking kernel32 into individual characters) to bypass static signatures for persistence and password theft. This successfully evaded Defender.
• CrowdStrike: The AI opted for a strategy of avoiding process injection or elevation, instead using .NET or PowerShell with classical APIs to access browser passwords, combined with obfuscation. Interestingly, this version was detected by Windows Defender.
• SentinelOne: The AI produced a hybrid approach, combining string obfuscation with Living Off The Land Binaries (LOLBINs) and attempting data exfiltration via memory read/write to an SQLite database. This, too, was detected by Windows Defender.

The attempts to disable EDR (e.g., "EDR freeze," BYOVD) were unsuccessful, as the AI couldn't find a vulnerable driver not already blacklisted by vendors. Wuest observed that LLM guardrails are a constant hurdle for attackers, requiring continuous adaptation of "do anything now" prompts. His PoC achieved 80% code quality (20% required verification) with a temperature of 0.2. A key challenge was the "stopping problem"—preventing the AI from going down rabbit holes (e.g., endlessly searching for a wallet.dat file), suggesting a need for hard limits (e.g., 10 attempts).

Other AI Attack Vectors

Wuest also touched upon other vectors:

• Moldbot/OpenClaw/Agent: These are often "click-fix" attacks that trick users into downloading malicious skills or granting excessive administrative rights to AI agents.
• Local Models: While desirable for stealth, distilling LLMs for local execution often results in models poor at coding or requires significant computational resources, flagging as crypto miners due to high CPU load.
• Abusing Company AI: A stealthy approach is to piggyback on existing enterprise AI tools (Co-Pilot, Gemini, Claude CLI) already whitelisted in the environment.
• Attacking the AI Environment: This includes poisoning skills, SCP servers, infecting IDE markdown files with backdoors, or leveraging prompt injection/indirect prompt injection and RAG (Retrieval Augmented Generation) poisoning to manipulate the AI's knowledge base.

Wuest concluded this section by referencing Google's Threat Intelligence Group (GTIG) reports, which highlight APT groups abusing Gemini for reconnaissance, translation, and vulnerability research. However, GTIG's assessment aligns with Wuest's: AI is not yet a game-changer for malware, and current techniques are not novel, often relying on existing MITRE ATT&CK framework tactics. Examples like Fruitshell (a PowerShell reverse shell with an "ignore me" comment for AI agents), Promptflux (Visual Basic script Trojan attempting self-re-encoding), Prompt Lock (NYU student project ransomware), and the newly identified Asku multi-staged downloader all demonstrate limitations or rely on existing C2 techniques. Even Entropic's claims of 80-90% automation by Chinese APTs lacked concrete IOCs (Indicators of Compromise), making verification difficult, and raised questions about why foreign APTs would use Western LLMs.

Demo / Proof of Concept

▶ Watch: Introducing truly adaptive, AI-powered runtime threats (7:50)

Candid Wuest presented a compelling proof of concept (PoC) called "Loop" to illustrate the capabilities and limitations of agentic AI malware. This demonstration focused on a PowerShell-based, fileless approach designed to orchestrate attacks using a reasoning AI model.

The "Loop" PoC was initiated by assuming a compromised system. The primary goal was either retrieved from a C2 server or decrypted from the binary. The AI orchestrator then broke this goal into sub-tasks. For each sub-task, it would query an LLM (in this case, Grok was used) to generate the necessary PowerShell code. The generated code would then be executed on the target system, and the results of that execution would be fed back to the AI. This feedback loop allowed for error correction and informed the generation of subsequent commands. Wuest also showcased the use of metamorphic prompts, where the AI would generate a new prompt (e.g., in German or French) to achieve the same objective, making it harder for static analysis to track.

During the live demonstration, Wuest walked through several steps:

1. Persistence: The AI was tasked with achieving persistence. It queried the LLM, received a PowerShell script utilizing a registry run key (a common, albeit not highly original, method), executed it, and confirmed persistence. It then generated a new prompt to ask for the same persistence method in English.
2. Information Gathering: The AI was then tasked with finding the external IP address of the system. It generated a simple PowerShell one-liner, executed it, and successfully retrieved the local IP address. Again, it generated a new prompt for the same task.
3. Data Exfiltration (Wallet Discovery): The PoC then moved to a more complex task: finding cryptocurrency wallets. The AI generated code for this, but initially, it contained an error. Wuest demonstrated the error correction capability, where the AI, after being informed of the error, debugged and fixed its own code. Once corrected, it successfully located and listed the contents of a wallet. The process reiterated with the AI attempting to generate a new command prompt to write this information into the registry and encrypt it.

Wuest highlighted that while the process worked, it operated at "machine speed"—meaning it wasn't instantaneously fast, as it still required round trips to the LLM for inference. He candidly admitted that a skilled pentester could likely type and execute commands faster. This underlined his point that it was an "evolution, not a revolution" in terms of immediate speed advantage for simple tasks.

A more advanced aspect of the demo involved the AI's ability to adapt obfuscation techniques based on the detected EDR solution. Wuest tested the same objective—achieving persistence and stealing browser passwords—on systems running Microsoft Defender, CrowdStrike, and SentinelOne:

• Against Microsoft Defender: The AI generated a PowerShell script employing classic string concatenation (e.g., breaking kernel32 into individual characters) to bypass static signatures. This technique successfully evaded Defender's detection.
• Against CrowdStrike: The AI's strategy was to avoid "fancy" techniques like process injection or elevation, instead opting to use standard .NET or PowerShell APIs to access browser passwords, combined with a different form of obfuscation. Interestingly, this CrowdStrike-targeted payload was subsequently detected by Windows Defender when tested on a different system.
• Against SentinelOne: The AI produced a mixed approach, combining string obfuscation with the use of Living Off The Land Binaries (LOLBINs) and attempting data exfiltration via a memory read/write to an SQLite database. This variant was also detected by Windows Defender in cross-testing.

This adaptive obfuscation demonstrated the potential for AI to dynamically tailor payloads. However, Wuest also noted that the AI's attempts to disable EDRs (e.g., using "EDR freeze" or Bring Your Own Vulnerable Driver - BYOVD) failed because it couldn't identify a vulnerable driver that hadn't already been blacklisted by EDR vendors. This highlighted a significant limitation: the AI's knowledge base often relies on publicly available information, which security vendors also monitor and update their defenses against.

The PoC underscored several key takeaways: the importance of specific prompt engineering, the constant cat-and-mouse game with LLM guardrails, a code quality of about 80% (requiring verification for the remaining 20%), the challenge of preventing the AI from drifting or going down rabbit holes, and the inherent noisiness of current AI-powered attacks due to external communication and resource consumption.

Defensive Implications

▶ Watch: Polymorphic malware: Not a new AI-powered threat concept (8:00)

Candid Wuest's analysis of agentic AI malware provides critical insights for defenders, emphasizing that while the hype often overshadows reality, the evolving capabilities of AI necessitate a proactive and adaptive defense strategy.

Firstly, Wuest asserts that behavior-based detection remains highly effective against AI-powered malware. Unlike static signatures, which AI can easily bypass through dynamic code generation and obfuscation, behavioral analysis can identify malicious actions regardless of the underlying code. This means well-configured EDR (Endpoint Detection and Response) solutions are crucial. However, the rapidly accelerating nature of AI-driven attacks means that the time to detect and respond is shrinking. Defenders must be quicker than the traditional 24-hour patching window, necessitating automated and agile response capabilities.

Secondly, defenders should be acutely aware of the various ways AI is being abused in the attack kill chain. This extends beyond just malware to areas like deepfakes for social engineering, AI-assisted vulnerability research (which fuels a rapid increase in zero-day exploits), and prompt injection/model poisoning. Organizations need to implement robust controls around their own AI usage, particularly to prevent shadow AI where employees might inadvertently expose sensitive data by copy-pasting it into public LLMs. Monitoring and blocking unauthorized external communication with LLM APIs can help mitigate risks associated with malware that relies on such external calls.

Thirdly, Wuest suggests innovative defensive tactics like deploying honey tokens and tripwires specifically designed to trap AI agents. This involves creating enticing, yet fake, data points (e.g., password.txt files filled with random data or designed to create endless loops) that AI malware might attempt to exfiltrate. Accessing these honey tokens would trigger immediate alerts, providing early warning of a compromise. Prompt injections within file names or content could also be used to confuse or derail an AI agent.

Fourthly, the challenge of attribution will become increasingly difficult. When malware is generated by an LLM, it lacks the unique coding style or specific indicators often used to link attacks to particular threat actors (e.g., APT28, Lazarus). While Frontier Labs (providers of major LLMs) might share information about who purchased accounts, this doesn't offer the same granular attribution as traditional malware analysis. Defenders will need to focus more on what the malware does and how it behaves rather than who created it.

Finally, Wuest reiterates that fundamental security practices remain paramount. The most effective attacks often bypass malware entirely by exploiting stolen identities and logging in as a domain administrator. This underscores the importance of strong identity and access management, multi-factor authentication, and adhering to the principle of least privilege. Furthermore, while AI is improving, its current reliance on external resources, its noisiness (high CPU usage for local models), and its unreliability can be exploited by defenders. By focusing on these known weaknesses and strengthening foundational security postures, organizations can build a resilient defense against the evolving landscape of AI-powered threats.

Key Takeaways

• Hype vs. Reality: Most "AI malware" discussed in media is either AI-generated (often flawed and detectable) or AI used for cybercrime (e.g., deepfakes, phishing), not truly autonomous AI within malware.
• Evolution, Not Revolution: Agentic AI malware, which dynamically adapts its behavior at runtime, is an evolution in attack capabilities, not a sudden, groundbreaking revolution. Its current form is often unreliable and noisy.
• Behavioral Detection is Key: Robust, behavior-based EDR solutions remain effective against AI-powered malware. However, the accelerating pace of AI-driven attacks demands faster detection and response times from defenders.
• AI Accelerates Attacks: AI significantly automates and speeds up various stages of the attack kill chain, particularly in vulnerability research and social engineering, shrinking the window for defensive action.
• Defensive Innovation: Defenders can deploy smart honey tokens and tripwires (e.g., prompt injections in filenames) to detect and derail AI agents. Monitoring and controlling AI tool usage within organizations is also critical.
• Attribution Challenges: AI-generated malware complicates attribution, as it lacks unique coding styles, making it harder to link attacks to specific threat actors.

About the Speaker(s)

Candid Wuest is a distinguished veteran in the antivirus and malware industry, boasting over 25 years of experience. Throughout his extensive career, he has been instrumental in the development of antivirus signatures that protect a vast array of systems, from critical national infrastructure like nuclear power stations and submarines to the International Space Station (ISS). Notably, his work led to the first-ever detection of malware in outer space—a World of Warcraft gaming trojan brought onto the ISS by a cosmonaut on an SD card. Wuest's deep technical expertise and long-standing engagement with the evolving threat landscape provide him with a unique and credible perspective on the realities of AI in cybersecurity.