ThreatCluster

Gemini AI Misused for Developing Self-Modifying Malware by Cybercriminals

First seen 5 Nov 2025, 17:08 UTC • •40

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Nation-state actors and cybercrime groups are utilizing Gemini AI to create a 'Thinking Robot' malware module capable of rewriting its own code to evade detection. This development also includes an AI agent designed to monitor and track the behavior of adversaries. The Google Threat Intelligence Group reported a notable shift in how attackers are leveraging Gemini, moving beyond mere productivity enhancements.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 225d ago How this analysis works

More articles in this cluster (2)

Threat Graph

13 entities, 30 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

APT28
APT42
Promptlock

Technique (4)

Malware
Phishing
Ransomware
T1566 - Phishing

Malware (2)

Promptflux
Promptsteal

Tool (4)

Gemini
Hugging Face
VBScript
VirusTotal

Relationships

APT28 uses Promptflux
APT28 uses Promptsteal
APT42 uses Promptflux
APT42 uses Promptsteal
Promptlock uses Promptflux
Promptlock uses Promptsteal
APT28 uses Gemini
APT28 uses Hugging Face
APT28 uses VBScript
APT28 uses VirusTotal
APT42 uses Gemini
APT42 uses Hugging Face
APT42 uses VBScript
APT42 uses VirusTotal
Promptlock uses Gemini
Promptlock uses Hugging Face
Promptlock uses VBScript
Promptlock uses VirusTotal
APT28 uses Malware
APT28 uses Phishing
APT28 uses Ransomware
APT28 uses T1566 - Phishing
APT42 uses Malware
APT42 uses Phishing
APT42 uses Ransomware
APT42 uses T1566 - Phishing
Promptlock uses Malware
Promptlock uses Phishing
Promptlock uses Ransomware
Promptlock uses T1566 - Phishing

Following this threat?

Track Promptlock, APT28 and Promptflux in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Emerging Threats from Autonomous AI Cyber Crime As organizations adopt AI technologies, the cybersecurity landscape is evolving, with AI-driven attacks becoming more prevalent. Check Point Research reported that 1 in 54 generative AI prompts from enterprise networks poses a high risk of sensitive data exposure, affecting 91% of organizations using AI tools. This…

ESET and Salesforce Address AI Security Challenges Amid Emerging Threats ESET has launched new features in its B2B portfolio to combat risks associated with the rise of AI-driven threats, including AI Agent Security and AI Behavioural Monitoring. This update aims to protect organizations from malicious AI components and suspicious AI activity. Meanwhile, Salesforce is seeking a Senior…