Ethical Hacking News
Researchers have discovered the first AI-powered ransomware, called PromptLock, which uses Lua scripts to steal and encrypt data on Windows, macOS, and Linux systems. The malware leverages OpenAI's gpt-oss:20b model to generate malicious scripts dynamically.
PromptLock is an AI-powered ransomware that uses large language models to encrypt and steal data from various platforms. The malware utilizes the SPECK 128-bit algorithm for encryption, which is unusual for ransomware but suitable for RFID applications. Researchers believe PromptLock is a proof-of-concept or work-in-progress, rather than an active ransomware in the wild. PromptLock demonstrates that AIs can be weaponized in malware workflows, offering cross-platform capabilities and evasion techniques. The emergence of PromptLock is not an isolated incident; other AI-powered malware like LameHug have been discovered recently. Cybersecurity researchers must continuously monitor emerging threats and update their detection methods to address the evolving landscape of AI-driven attacks.
The recent discovery of PromptLock, an AI-powered ransomware, has sent shockwaves through the cybersecurity community. This type of malware is a significant threat, as it utilizes artificial intelligence (AI) and large language models to encrypt and steal data from various platforms, including Windows, macOS, and Linux systems.
PromptLock is written in Golang and leverages OpenAI's gpt-oss:20b model through the Ollama API to dynamically generate malicious Lua scripts. These scripts are then used to execute tasks such as local filesystem enumeration, target files inspection, data exfiltration, and file encryption. The malware uses the lightweight SPECK 128-bit algorithm for encryption, which is an unusual choice for ransomware but still considered suitable for RFID applications.
The researchers from ESET believe that PromptLock is a proof-of-concept or work-in-progress, rather than an active ransomware in the wild. This theory is supported by several signs, including the use of a weak encryption cipher (SPECK 128-bit), a hard-coded Bitcoin address linked to Satoshi Nakamoto, and the fact that the data destruction capability has not been implemented.
However, even if PromptLock is indeed a concept tool, its appearance holds significance in demonstrating that AIs can be weaponized in malware workflows. This evolution offers cross-platform capabilities, operational flexibility, evasion, and lowers the bar for entry into cybercrime. It also shows that AI-powered malware can adapt quickly to new systems and environments.
The emergence of PromptLock is not an isolated incident. Other recent examples include LameHug, a Windows shell commands generator powered by an LLM (Large Language Model), which was discovered in July 2025 by Ukraine's CERT and believed to be deployed by Russian hackers from the APT28 group. This malware leverages API calls instead of PromptLock's proxying, achieving the same practical result but with different complexity.
The latest developments in AI-powered ransomware highlight the importance of staying vigilant in the cybersecurity world. Cybersecurity researchers must continuously monitor emerging threats and update their detection methods to address the evolving landscape of AI-driven attacks.
In conclusion, the discovery of PromptLock marks a significant milestone in the development of AI-powered malware. As the threat landscape continues to evolve, it is crucial for organizations to prioritize robust security measures and stay informed about emerging threats to protect themselves against this growing risk.
Related Information:
https://www.ethicalhackingnews.com/articles/New-AI-Powered-Ransomware-A-Threat-to-Cybersecurity-ehn.shtml
https://www.bleepingcomputer.com/news/security/experimental-promptlock-ransomware-uses-ai-to-encrypt-steal-data/
https://www.pcmag.com/news/mysterious-promptlock-ransomware-is-harnessing-openais-model
https://securityaffairs.com/181595/malware/eset-warns-of-promptlock-the-first-ai-driven-ransomware.html
Published: Wed Aug 27 16:12:26 2025 by llama3.2 3B Q4_K_M
