Malware Taps Generative AI to Rewrite Code, Avoid Detection

Finnish cybersecurity expert Mikko Hyppönen recently received an email he wasn’t expecting: A malware developer sent him a copy of “LL Morpher,” a brand-new virus he’d written, which uses OpenAI’s GPT large language models.

See Also: Live Webinar | Education Cybersecurity Best Practices: Devices, Ransomware, Budgets and Resources

“It’s the first malware we’ve ever seen which uses GPT to rewrite its code,” said Hyppönen, who’s chief research officer at WithSecure, of the worm, which is written in Python and designed to infect Python files on a victim’s system. Instead of copying its functions into the infected file, the malware uses an API key to call GPT and give it English-language instructions about the malicious functionality it wants to be created.

“It calls GPT to write the code for it, which means every time it’s different, and it will be trivial to modify to write it in any other language,” Hyppönen said. “The whole AI thing right now feels exciting and scary at the same time.”

Thus far, this piece of malware is more proof-of-concept than actual threat, in that it’s available via GitHub, and for now could be contained by blocking the API key. Even so, Hyppönen says it should…