LLM-Powered Malware Guide: LAMEHUG and AI Implants

Malware has started asking large language models what to do next: instead of carrying its commands, it sends a prompt to a hosted or local model at runtime and executes whatever comes back. The first case seen in live operations was LAMEHUG (also tracked as PROMPTSTEAL), which CERT-UA reported in July 2025 and which ATT&CK attributes to APT28. This guide explains how runtime LLM querying works, which families have been documented and how far each got, what it changes for detection, and why the API keys these implants carry are both their weak point and a non-human identity problem for the providers and organisations whose keys are stolen. It is for SOC analysts, detection engineers, threat intelligence teams and the owners of AI platform credentials. It is defensive only. For the wider picture of AI in attacks, see the AI-Powered Cyber Attacks Guide; this page goes deeper on implants that call models during execution.

Key takeaways

The logic moves out of the binary. LLM-powered malware sends natural language tasks to a model and runs the returned commands, so static signatures on hard-coded commands have less to match.
One family is confirmed in operations. Google Threat Intelligence Group (November 2025) lists PROMPTSTEAL/LAMEHUG and QUIETVAULT as observed in operations, and PROMPTFLUX and PROMPTLOCK as experimental; MalTerminal and PromptLock are assessed as proofs of concept.
Embedded keys are the brittle point. SentinelLABS found 284 unique Hugging Face API keys across LAMEHUG samples; once a provider revokes a key, the implant loses its brain.
The traffic looks like normal AI use. Calls go to legitimate endpoints such as router.huggingface.co or the Gemini API, so detection needs process context: which binary is calling an AI API, and should it be?
Your AI keys are someone else's malware fuel. Leaked or stolen LLM API keys power these tools, so secret scanning, scoped tokens and fast revocation are part of the defence.

How the attack works

Traditional malware ships with its commands compiled in or downloads them from attacker command and control (C2). LLM-powered malware adds a third source: a model. The implant holds a prompt describing a goal (for example, "collect system information" or "find documents") and credentials for a model API, sends the prompt at runtime, receives generated commands or code, and executes them. ATLAS records this as Generate Malicious Commands (AML.T0102), and ATT&CK maps LAMEHUG's use of the Hugging Face API to Bidirectional Communication over a web service (T1102.002).

Stage	LAMEHUG as documented	Source
Delivery	Spearphishing from compromised government accounts impersonating ministry officials; ZIP attachment holding a PyInstaller-packed Python executable (.pif) or files posing as AI tools, such as AI_generator_uncensored_Canvas_PRO_v0.9.exe	ATLAS AML.CS0044; ATT&CK T1566.001, T1204.002, T1036.005
Model query	Hugging Face API, model Qwen2.5-Coder-32B-Instruct; queries can be encoded	ATT&CK T1102.002, T1132; Splunk
Execution	Generated one-line Windows commands run through cmd.exe: systeminfo, wmic, whoami, dsquery, net start, xcopy	Splunk; ATT&CK T1047, T1082, T1087.002, T1482
Collection	System details written to C:\ProgramData\info\info.txt; Documents, Desktop and Downloads searched recursively and copied to the same folder	ATLAS; ATT&CK T1119, T1074.001
Exfiltration	SFTP or SSH with hard-coded credentials, or HTTP POST to attacker infrastructure	Splunk; ATT&CK T1041, T1573.002, T1071.001

The model is not the C2: the operator still receives the data on their own server. What the model provides is flexible tasking and less tell-tale command text in the binary. Most observed variants either carry a key for a hosted API (LAMEHUG, PROMPTFLUX) or run a local open-weight model (PromptLock used gpt-oss-20b through the Ollama API, according to ESET). Local models avoid key revocation but need a model runtime on the host, which is itself a strong signal on most corporate endpoints.

Where it shows up

Family	Type	Model access	Status as reported
LAMEHUG / PROMPTSTEAL (ATT&CK S9035)	Python data miner, Windows	Hugging Face API, Qwen2.5-Coder-32B-Instruct, embedded keys	Observed in operations against Ukraine; APT28 (CERT-UA: medium confidence, per BleepingComputer)
PROMPTFLUX	VBScript dropper	Gemini API with a hard-coded key; asks the model to rewrite its own code	Experimental; Google disabled associated assets
QUIETVAULT	JavaScript credential stealer	Uses on-host AI command line tools to hunt for GitHub and npm tokens	Observed in operations
FRUITSHELL	PowerShell reverse shell	None; carries prompts meant to mislead LLM-based security analysis	Observed in operations; publicly available
PromptLock	Go ransomware, Windows and Linux	Local gpt-oss-20b through Ollama; generates Lua scripts	Proof of concept, matching an academic prototype (ESET)
MalTerminal	Python generator of ransomware or reverse shell	OpenAI GPT-4 via an endpoint deprecated in November 2023	Proof of concept or red team tooling (SentinelLABS)

Two adjacent patterns are worth separating. QUIETVAULT does not need its own key: it abuses AI tools the developer has already installed and authenticated, which turns a workstation's AI assistant into the attacker's search engine. And many reported "AI malware" cases are about development, not runtime: Anthropic's August 2025 threat report describes a low-skilled actor using Claude to develop and sell ransomware variants, and another using Claude Code in a data extortion campaign against at least 17 organisations. That code does not call a model when it runs, so conventional detection applies.

Impact

Weaker static detection: commands are generated at runtime, so the binary contains prompts and keys rather than command strings. Behavioural detection on the executed commands still works, because the model has to produce ordinary system commands.
Blended network traffic: calls to Hugging Face, Gemini or OpenAI endpoints are common in organisations that use AI, so domain blocklists are rarely an option.
Lower skill barrier: operators can describe goals rather than write tooling. The current families are crude, and the documented commands (systeminfo, dsquery, xcopy) are the same ones a human operator would run.
Credential exposure for third parties: embedded keys usually belong to someone else, so the victim of the key theft pays for and is associated with the attack traffic. GTIG assessed that LAMEHUG likely used stolen tokens.
Unpredictability: generated commands can differ between runs, which complicates incident scoping. Responders should reconstruct what actually executed from process telemetry, not from the prompt.

Detection

The constant is that some process on the host calls an AI service and then runs what it receives. Build detection around that sequence.

Signal	Telemetry	What to look for
AI API lookups from unexpected processes	Sysmon Event ID 22 (DNSEvent), proxy logs	python.exe, cmd.exe, rundll32.exe, powershell.exe or pwsh.exe resolving huggingface.co, router.huggingface.co, generativelanguage.googleapis.com or api.openai.com, on hosts with no sanctioned AI tooling (Splunk ships a "Windows AI Platform DNS Query" analytic for this)
Discovery bursts after an AI call	Sysmon 1, Security 4688 with command line	systeminfo, wmic, whoami, dsquery and net start spawned by an unsigned or PyInstaller binary within seconds of an AI API connection
Staging	Sysmon 11 (FileCreate)	Document copies into C:\ProgramData subfolders; xcopy of Documents, Desktop and Downloads
Local model runtimes	Software inventory, Sysmon 3 (NetworkConnect)	Ollama or similar runtimes listening on localhost on hosts without an approved use case
Embedded keys in files	YARA, secret scanners on email attachments and endpoints	Strings matching LLM provider key formats (for example, Hugging Face tokens beginning hf_) inside executables or scripts
AI CLI misuse	EDR process lineage	AI command line tools launched by scripts or unexpected parents, followed by reads of token files or repository creation

SentinelLABS showed that hunting on key structure and on prompts stored as code works at scale: a year-long retrohunt found more than 7,000 samples with over 6,000 unique keys, most of them not malicious, so triage matters. Prompts are useful intelligence because they state intent in plain language. See the YARA Rules Guide and the Sysmon Guide.

Metrics

Attribution of AI traffic: percentage of outbound AI API connections attributed to a sanctioned application or gateway (target above 95%).
Unknown caller alerts: number of hosts per month where a non-sanctioned process contacted an AI API, and median time to triage.
Key exposure time: median time from a leaked AI key being detected to its revocation (target under one hour).
Scoped token share: percentage of production AI tokens that are fine-grained or short-lived.
Detection test pass rate: share of emulated "AI call then discovery" sequences detected in purple team tests.

Prevention and hardening

Phased approach

Inventory sanctioned AI use. List which applications, users and servers are expected to call which AI providers. Without this, every AI call is ambiguous. See the AI Usage Monitoring Guide.
Route AI traffic through a gateway. Send sanctioned model traffic through an AI or LLM gateway or a known egress proxy, so direct calls from endpoints stand out. See the AI Gateway and LLM Gateway Guide.
Alert, then restrict. Start with alert-only detections for AI API access by non-sanctioned processes for two to four weeks, tune for developer tools, then move to blocking direct access from standard user endpoints. Roll back per group by restoring the egress allow rule, not by removing the detection.
Harden delivery paths. LAMEHUG arrived as a ZIP with a .pif or fake AI tool executable. Block executable and .pif content in archives at the mail gateway and restrict execution of unsigned binaries from user-writable paths. See the Email Security Guide.
Protect your own AI keys. Treat model API keys as non-human identities: one token per application, fine-grained scopes, short-lived credentials for CI (Hugging Face Trusted Publishers exchange an OIDC token for a short-lived Hub token), and secret scanning in repositories. See the LLMjacking Guide and the Git Secret Scanning Guide.

Key revocation response

When an LLM key is found inside malware, revocation is both containment and disruption. Hugging Face documents a public endpoint (POST /api/credentials/revoke) that lets anyone invalidate a leaked token, with immediate effect and an email notice to the owner; other providers take abuse reports. Practical steps:

If the key is yours: revoke or refresh it, review the provider's usage logs for the attacker's prompts and volume, rotate any sibling keys stored in the same place, and find how it leaked.
If the key is someone else's: report it to the provider through its abuse or revocation channel and share it with your intelligence partners; do not test it.
Either way: record key prefixes or hashes as indicators, since samples carry many keys and new ones appear as old ones die.

Decision guidance

Small organisations without AI in daily use can simply block AI API domains from endpoints by default and allow named exceptions; this removes most of the risk cheaply. Organisations with broad AI adoption cannot block, and should invest in a gateway, process-level attribution of AI traffic and endpoint detection of local model runtimes. Developer estates sit in between: allow sanctioned assistants, but alert when interpreters or unsigned binaries call AI APIs directly, and watch AI CLI tools for misuse.

Lessons from incidents

Leaked AI tokens are a ready supply. The Hugging Face API Tokens Exposed 2023 research found 1,681 working tokens in public repositories, reaching 723 organisations. Tokens left in code are exactly what key-carrying malware needs.
Stolen AI keys are already monetised. The LLMjacking 2024 to 2026 case shows attackers taking cloud and AI keys from compromised servers and public code to run models at victims' expense. LLM-powered malware is the same key economy with a different purpose.
Blocking by domain fails in AI-heavy estates. LAMEHUG used the same Hugging Face endpoints as legitimate users, so only process context distinguished it.
Over-weighting the AI label. The documented LAMEHUG commands were standard discovery and copy commands. Teams that wait for "AI detection" products miss what their existing process telemetry can already see.
Revoking one key and stopping. Samples embed many keys, so revoking a single key buys hours. Hunt for the full set and keep the indicator list growing.

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK v20	S9035 LAMEHUG; T1102.002, T1566.001, T1204.002, T1119, T1074.001, T1041	Behaviour to detect
MITRE ATLAS	AML.T0102 Generate Malicious Commands; case study AML.CS0044	AI-specific technique
NIST CSF 2.0	DE.CM-01, DE.CM-09, PR.AA-01	Network and endpoint monitoring; credential management for AI keys
NIST SP 800-53 Rev. 5	SI-3, SI-4, SC-7, CM-7, IA-5	Malicious code protection, monitoring, egress control, least functionality, authenticator management
CIS Controls v8.1	9 Email and Web Browser Protections, 10 Malware Defenses, 13 Network Monitoring and Defense	Delivery, execution and egress controls
ISO/IEC 27001:2022 Annex A	A.8.7 Protection against malware, A.8.16 Monitoring activities, A.8.23 Web filtering	Control objectives

Practitioner checklist

Publish an inventory of sanctioned AI providers, applications and hosts, and route their traffic through a gateway or known proxy.
Enable Sysmon 22 and process command line logging, and alert on AI API lookups from interpreters, shells and unsigned binaries.
Correlate AI API connections with discovery commands (systeminfo, wmic, whoami, dsquery) from the same process tree.
Detect unapproved local model runtimes such as Ollama on standard endpoints.
Block .pif and executables inside archives at the mail gateway.
Scan attachments, endpoints and repositories for LLM provider key patterns.
Use fine-grained, per-application AI tokens and short-lived CI credentials; revoke leaked keys within an hour.
Write a key revocation runbook covering your own keys and third-party keys found in malware.

LLM-Powered Malware Guide: LAMEHUG, Embedded API Keys and How to Respond