Of the 405 AI-themed malware samples Unit 42 collected, only 12 appeared in Cortex XDR telemetry on customer endpoints — a gap that frames the report's most important finding.
405-sample dataset and telemetry coverage
Unit 42 assembled 405 unique SHA-256 hashes from WildFire analysis reports, VirusTotal Intelligence and published open-source intelligence. The team queried those samples across multiple telemetry sources: Cortex XDR endpoint telemetry (December 2024–June 2025), WildFire session data for samples forwarded by Next-Generation Firewalls and Cortex XDR agents (June 2024–June 2025), Cortex XDR alert records, and WildFire sandbox verdicts. The result: approximately 97% of samples exist only in sandboxes and public repositories, and only 12 samples were observed on Cortex XDR-protected endpoints. Palo Alto Networks products detected and blocked every sample that attempted to reach a customer environment.
Three dominant sample categories: proof-of-concept, testing, and brand abuse
The samples that never appeared in production telemetry clustered into three groups:
- Proof-of-concept and research code: LLM-powered ransomware frameworks with hard-coded test parameters (for example, ransom addresses pointing to the Bitcoin Genesis Block), AI-assisted reconnaissance scripts used in conference demos, and modular frameworks meant to test AI integration patterns rather than to compromise real targets. Many of these contain localhost/private IP targets, verbose debug logging, single uploads by research organizations, and file paths with terms like research, mal or analysis.
- Security validation and testing: Submissions from breach-and-attack simulation (BAS) platforms and internal security teams. These uploads often show multiple submissions of the same hash from the same organization during business hours and originate from IP addresses tied to testing infrastructure.
- AI-themed brand abuse: Samples that use AI company names or product terms in filenames but carry conventional malware payloads. These are social-engineering lures — real threats to end users who install them, but not novel AI-enabled techniques.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildFive malware families observed in production endpoints
Twelve samples that reached endpoints across organizations in three countries represented five families: FunkSec ransomware, a trojanized AI application (Recipe Lister), the Oyster backdoor, the Rhadamanthys stealer, and a COM-hijacking DLL. Key specifics:
- FunkSec ransomware: Seven distinct variants compiled between Jan. 1–6, 2025, sharing a Rust codebase and evasion steps such as disabling Windows Defender via PowerShell and registry edits, deleting volume shadow copies, and changing desktop wallpaper to a ransom note. PDB paths embedded in binaries (Dev.pdb, Funksec.pdb, Darkzone.pdb, Darkfunk.pdb) indicate a rapid development cadence consistent with LLM-assisted iteration. WildFire classified all seven as malware, and Cortex XDR generated alerts for every variant that executed.
- Recipe Lister NSIS installer: The most widely encountered sample masqueraded as a recipe-finding app, signed with a code-signing certificate issued to Global Tech Allies Ltd. (a certificate later revoked). It extracted and ran a JavaScript backdoor, appeared across more than 50 organizations, and produced over 6,500 endpoint profile records and 9,600 XDR alerts in the observation window. Cortex XDR blocked the binary in all protected environments.
- Oyster backdoor via trojanized Dropbox installer: A signed installer whose Authenticode subject read Dropbox, Inc. dropped an AutoIt loader that side-loaded the Oyster (aka CleanBoost) backdoor — an example of attackers using signatures to lend false legitimacy to loaders.
- Rhadamanthys stealer: A .NET executable named redist.exe delivered Rhadamanthys with active command-and-control communication; Unit 42 notes this sample was part of an AI-enabled infection chain reported previously.
- COM hijacking DLL: A DLL named 360Util.dll impersonating 360 Total Security implemented persistence through COM object hijacking; its PDB path references 360Util.pdb and it was delivered alongside AI-branded lures.
Detection mechanisms that worked — and what AI changed
Unit 42 found that the same defensive mechanisms used against conventional malware stopped the AI-enabled samples observed in production. Effective controls included sandbox detonation, behavioral analytics, code-signing anomaly detection and entropy analysis. Examples in the report illustrate layered defense: a legitimate-looking signature initially suppressed static detection for Recipe Lister, but behavioral signals (an uncommon signer and file entropy near 0.999970) and the WildFire cloud verdict produced the definitive block. The report emphasizes that the AI element altered how code was authored, not how it executed; none of the observed samples required a novel detection approach.
What this means for technologists, enterprise defenders, and end users
- Technologists and security teams: Maintain sandboxing, behavioral analytics and code-signing anomaly detection — the report shows those controls detected and blocked the production samples. Rapid iteration in FunkSec's PDB histories suggests defenders should watch for higher variant churn even if attack techniques remain familiar.
- Enterprise procurement and risk teams: Monitor certificate reputation and revocation status (the Recipe Lister sample used a certificate later revoked) and expect adversaries to use AI branding as a social-engineering vector rather than as a guaranteed technical innovation.
- End users and general staff: Exercise caution with AI-branded installers and unfamiliar signed binaries; social-engineering lures that mimic popular AI tools were a common thread in samples delivered to organizations.
The bottom line: AI-enabled malware exists and accelerates authorship in some cases, but Unit 42's telemetry shows that, as of the study period, most samples never escaped research and testing environments. Where AI-themed malware did reach endpoints, existing layered defenses detected and blocked it. Organizations that maintain sandboxing, behavioral detection and code-signing scrutiny remain positioned to intercept these threats as they evolve. For urgent incidents, Unit 42 advises contacting the Unit 42 Incident Response team.
