As cited
Copy frozen at (site build).
threat intel
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Malware authors are embedding natural-language instructions in binaries to evade artificial intelligence (AI) analysis tools used by defenders, a technique class called AI-Analysis Evasion (A3). Cisco Talos identified four malware families, FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, employing evolved evasion methods including template spraying across multiple large language model (LLM) formats and intimidation tactics. Testing showed simpler direct-instruction techniques succeeded about 35% of the time in steering model verdicts toward benign classification, while more complex implementations often backfired.
Why it matters: Security teams relying on AI-assisted malware analysis and triage pipelines must treat extracted binary strings as evidence signals rather than instructions, and design prompt construction to prevent injection attacks; MANTLEMAZE samples also reference CVE-2015-2291 (CVSS 3.1: 7.8), an actively exploited driver vulnerability used by nation-state and criminal groups to disable endpoint detection and response (EDR).
- Source published
- First seen by Cybersecurity Tracker