Google’s Threat Intelligence Group has identified malware that uses artificial intelligence to rewrite itself while it runs, making it harder for security software to catch. The most advanced version has already been used in live attacks by a Russian government-backed hacking group.
The experimental malware, called PROMPTFLUX, was discovered in June 2025. It is built to contact Google’s Gemini AI model and ask it to generate new ways to disguise its own code. One variant instructed Gemini to rewrite the malware’s entire source code every hour, keeping only the pieces needed to keep it functioning. Google calls this an early example of “just-in-time” AI embedded directly into malicious software, rather than relying solely on functions written in advance.
PROMPTFLUX was still in development when Google found it. Researchers had not seen it successfully break into a victim’s device or network, and Google has since disabled the infrastructure tied to it.
Russian Hackers Already Using AI-Powered Malware in the Field
The threat did not stay theoretical for long. Google identified APT28, a hacking group backed by the Russian government, using a separate strain called PROMPTSTEAL against targets in Ukraine. Google says this marks the first time it has observed malware querying a large language model while actively deployed in a real operation.
PROMPTSTEAL works differently than PROMPTFLUX. Instead of rewriting itself, it queries an AI model called Qwen2.5-Coder-32B-Instruct through the platform Hugging Face. That model generates Windows commands the malware then executes to gather information from an infected computer and copy files from folders such as Documents, Downloads and Desktop. The stolen data is sent back to infrastructure controlled by the attacker.
An Android Backdoor That Reads Your Screen
Google also detailed an Android backdoor called PROMPTSPY, first identified by security firm ESET, in a May 2026 report. It contains a module called GeminiAutomationAgent that sends information about what’s on an infected phone’s screen to Gemini and uses the response to help navigate the device.
Google found the malware could also resist removal. When a victim tried to uninstall PROMPTSPY, it could place an invisible overlay over the uninstall button so taps appeared to do nothing.
Google says it took action against the group behind PROMPTSPY and that no apps containing it were found on Google Play as of its May report. Known versions are detected by Google Play Protect, which is enabled by default on Android devices running Google Play Services.
Attacks Now Run in Hours, Not Weeks
On September 8, 2026, Google’s Threat Intelligence Group reported a broader shift: attackers moving from simple AI prompting toward
