First AI-powered ransomware PromptLock identified as prototype

Security researchers have identified what is described as the first known AI-powered ransomware in the wild, a development that could shape the trajectory of cyber threats in the coming years. The malware, dubbed PromptLock, is a Golang-based program that, for the moment, appears to be a proof-of-concept or work-in-progress. It relies on a locally hosted large language model to generate Lua scripts on the fly, which are then executed to scan targets, exfiltrate data, and encrypt files across Windows, Linux, and macOS. The researchers caution that the destruction feature shown in some demonstrations has not yet been implemented, and there is little evidence of widespread deployment to victims to date.

PromptLock operates by calling a public AI model through a local interface to produce malicious Lua code in real time. The scripts are designed to be cross-platform and capable of enumerating the local filesystem, inspecting files for potentially sensitive information, exfiltrating data, and encrypting selected material. The encryption uses a lightweight 128-bit cipher. Because the scripts are AI-generated and tailored to the specific files encountered on a system, the indicators...