PromptFlux Malware Uses Gemini to Rewrite and Hide Itself in Real Time

Back Cyberinsider

PromptFlux Malware Uses Gemini to Rewrite and Hide Itself in Real Time

Cyberinsider • November 5, 2025

Share: View original

Google has uncovered a VBScript dropper dubbed PromptFlux, which dynamically rewrites and mutates its own code using Google's Gemini API.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PromptFlux Malware Utilizes Gemini AI for Dynamic Code Mutation Google has identified a new malware named PromptFlux, which employs a VBScript dropper to dynamically rewrite and mutate its own code in real time using the Gemini API. This malware can adapt its code structure hourly, making it difficult for traditional static defenses to detect and mitigate. The evolving nature of PromptFlux poses challenges for cybersecurity teams in managing vulnerabilities. 2 sources 44

Extracted Entities

Attack Types (1)

Malware (1)

Tools (1)