Amidst the growing use of generative AI, cybercriminals have started misusing generative AI to develop AI-coded malware, to have unauthorized access to victims’ devices. This alarming trend allows tech-savvy individuals to create malicious software more easily, posing new challenges for cybersecurity experts.
Security researchers at HP have discovered a new variant of the AsyncRAT remote access trojan that appears to have been coded using generative artificial intelligence. The modified malware was identified during a recent investigation conducted by the company’s Wolf Security team.
According to HP, the latest version of AsyncRAT employs a novel injection technique that is likely the result of generative AI development. This technique allows the malware to gain unauthorized access to a victim’s computer and potentially steal sensitive data or execute malicious commands.
New AI-Coded Malware Injection Method Found
While the original AsyncRAT was created by human attackers, the newly discovered variant showcases an injection technique that bears the hallmarks of artificial intelligence involvement. According to HP’s report, this marks one of the first documented instances where AI appears to have been employed to create malicious code.
Generative AI has been known to create phishing websites and scams, but until now, there has been limited proof of AI-coded malware. Researchers concluded that AI played a significant role in the creation of this variant from the structure of the code, along with comments accompanying each function.
Cybercriminals typically avoid including detailed comments in their code, as they do not want others to easily understand or replicate their work. However, the organized format and clear labeling of functions made it obvious that an AI system had likely been involved.
Attack Details Revealed by HP Researchers
HP’s investigation started when a suspicious email was sent to a user of their Sure Click security software. The email, written in French, was disguised as an invoice, indicating that the attackers were likely targeting French-speaking victims.
Although the code was encrypted and required a password to unlock, HP’s team was able to crack it and reveal the malicious content. The AI-coded malware contained a Visual Basic Script (VBScript) that manipulated the user’s registry, installed a JavaScript file, and triggered further processes. Ultimately, the malicious code installed the AsyncRAT malware, which allowed remote control of the victim’s device.
Generative AI Opens New Doors for Cybercriminals
AsyncRAT itself has been around since 2019, initially released as an open-source tool on GitHub. While its creators claimed it was a legitimate program for remote administration, it quickly became a favorite among cybercriminals for remotely controlling victims’ computers through AI-coded malware. The software gives attackers complete control over infected computers, allowing them to steal sensitive information such as cryptocurrency wallets and personal data.
The new AI-assisted variation of AsyncRAT highlights the growing concern over generative AI’s impact on cybersecurity. By using AI tools, attackers can now create more complex malware, making it easier to infiltrate systems and cause harm. According to the HP report, this development lowers the bar for criminals looking to exploit vulnerable systems.
As generative AI continues to evolve, experts fear that these tools will further fuel cybercrime, forcing cybersecurity teams to rethink their strategies. For now, researchers remain focused on tracking these advancements and understanding the full extent of AI’s role in future cyberattacks.
Also See: MAGA Token Sees 17% Surge Amid Trump’s Rising Influence
