India, Nov. 6 -- Google's Threat Analysis Group (TAG) discovered a new type of malware we'll call PromptFlux. PromptFlux utilizes generative AI, including ChatGPT, Gemini, and other generative AI tools to facilitate phishing, misinformation, or code generation. We first noticed this campaign in mid-2025, which illustrates how threat actors can leverage large language model (LLM) APIs to mask their cyberattacks behind a legitimate AI infrastructure.

According to Google's Threat Analysis Group, PromptFlux is a fully featured, modular malware framework for automating malicious tasks with LLMs (using compromised API keys and developer credentials). The infrastructure used for the PromptFlux campaign relies heavily on rotating proxy networks ...