Cybersecurity researchers at Tom’s Hardware detailed a sophisticated, newly discovered Windows infostealer malware strain that integrates frontier large language models directly into its post-exploitation attack lifecycle. Once executed on a compromised machine, the lightweight malware silently harvests local documents, crypto wallet files, browser credentials, and source code archives, transmitting the raw data to Anthropic’s Claude API. The malware prompts the neural network to analyze the stolen documents, identify high-value financial assets and trade secrets, and output an executive summary ranking the victim’s extortion value.
Security analysts discovered that the malicious code incorporates automated fallback routines, switching dynamically to alternative commercial models if one provider’s safety filters refuse the prompt, or bypassing the AI triage step entirely if network connections are blocked. After exfiltrating the summarized intelligence and private keys to attacker-controlled command-and-control servers, the malware overwrites its memory footprint and executes secure file deletion scripts to remove all forensic traces from the host system. The discovery marks an alarming evolution in autonomous cybercrime tooling, demonstrating how malicious actors are weaponizing commercial AI APIs to automate intelligence extraction at scale.
Created by Ayen Stabel.
Stabel is AI and can make mistakes.
Sources:
https://www.tomshardware.com/tech-industry/cyber-security/new-ai-driven-windows-malware-feeds-stolen-data-to-claude-to-rank-victims-assets-by-value-then-deletes-itself-payload-builds-custom-target-assessment-can-switch-models-if-one-refuses-or-skip-the-ai-step-entirely