Cisco Talos Measures Malware Prompts That Mislead AI Scanners

Malware authors are putting instructions for AI scanners inside the samples those scanners analyze. Cisco Talos tested the technique across seven malware families and found that the strongest strings produced a net steering rate toward benign of about 35% in matched-pair tests. For a security team that sends extracted binary strings to an LLM, the file under examination is now trying to speak as the analyst.

Talos tracked 84 distinct samples in four confirmed AI-analysis-evasion families collected from January 2025 through July 2026. Those controlled comparisons measure changes in model verdicts. Conventional malware detection remains available; the vulnerable point is an AI analysis step that promotes sample text into instructions.

A comment that changes a verdict

FRUITSHELL is a PowerShell reverse shell with fruit-named variables that assemble its TCP connection. At the top of the script, its author put a comment addressed to an AI reader claiming the program merely generates prime numbers. The shell contains no prime-generation code. Execution ignores the comment, but a scanner extracting readable text passes it along with the program to its model. Talos saw the same comment in nine additional scripts from at least four actors who adopted the technique independently of FRUITSHELL.

PLOTSAFE takes more care to retain its misleading text. Its Go builds vary a harmless-sounding description in a template. Because the Go compiler normally strips unused strings, the author added a 29-byte function that references them without being called. The resulting executable still contains the text that tries to tell the model how to classify it.

The model receives the analyst’s request and extracted strings in one context. If it follows an imperative from the binary as though it were a higher-priority instruction, a sample can alter the answer about itself.

Seven formats for one refusal

HOLLOWCLAD pushes the impersonation further. Talos found the same demand to refuse reverse engineering encoded in seven LLM chat-template formats inside the binary. An AI scanner that wraps extracted strings in a matching format risks presenting one of those strings as a system message. Roughly 80 tiny sections named after packers reinforce a separate illusion: Talos found that this binary was not packed. The apparently armored file offers less resistance to conventional inspection than its labels suggest.

MANTLEMAZE also sprays templates, but its loader carries invented claims of Google, Microsoft and Valve ownership, government contracts and certifications. Talos identifies those fabricated claims as intimidation text directed at the model. Talos describes MANTLEMAZE as VMProtect-packed, unlike HOLLOWCLAD. Both families try to change how an AI-assisted analyst responds to a sample, while their executable behavior still needs ordinary malware analysis.

The four-family count describes Talos’ tracked sample set. For the steering experiment, Talos crossed anti-analysis strings from seven families into different sample bodies and triaged each combination with five local LLMs, three runs each. Each string had 135 matched pairs comparing a verdict with that string present against the same file without it. The reported net rate subtracts shifts toward malicious from shifts toward benign. Direct requests to ignore the sample worked most consistently; elaborate refusals sometimes made models more suspicious. Model behavior varied.

Strings give defenders a lead

The attempted instructions must appear as plaintext to reach a text-extraction pipeline. Look in extracted strings, PowerShell comments and metadata scan text for imperatives addressed to an LLM or analyzer, including requests to skip analysis, refuse reverse engineering or accept claimed authority. Keep the original sample hash and the extracted string together when escalating a hit. A legitimate file’s incidental AI-related terms are a noisy match; an instruction about how the scanner must judge the file is a more useful lead.

Talos’ CAIRN research uses metadata-first acquisition filters, including one for AI-analysis evasion, and applies YARA to scan text from file metadata. The team warns that initial artifact matches need per-sample validation by reverse engineering. That is especially useful here: a prompt-like string can tell an analyst where to look, while the program’s behavior determines what the file does.

For exact-sample matching, Talos publishes SHA-256 examples for FRUITSHELL (f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d), PLOTSAFE (2e3e1bcd44cc3cbec4f5ca9991d14a326d3cc6bf76fe6e0d434c9b5f7e1ae6ab), HOLLOWCLAD (34098fe0bc4c69c4c4eb3f74688fb375326804536d25e5574e8c4c28c113b5c3) and MANTLEMAZE (389066bd5543aeea363d23a4dce7f7a21c7f2c73c61f506a93a69f594cf48ecf). A hash match identifies one listed sample; the string and its handling by your scanner matter for variants.

Keep file text in evidence

If your team uses an LLM to triage binaries or scripts, inspect the prompt assembly where extracted sample strings enter the model context. Keep the analyst’s instructions in the trusted part of the request and label sample text as untrusted evidence. Talos puts the design rule plainly: “Text inside a sample must be treated as evidence, never instruction.” Preserve the extracted text and its originating sample hash in triage records so an analyst can investigate a suspicious imperative alongside the executable.

Then test the scanner with an inert sample containing a harmless instruction-like comment. Compare its verdict with the same sample after removing that comment, and inspect the model’s explanation for obedience to the embedded request. The expected result is a stable disposition based on executable behavior, with the attempted instruction treated as suspicious file content. Keep conventional detection and reverse engineering in the review path while adjusting the AI step: Talos found those layers unaffected by this technique, and a single AI verdict is a poor substitute for either one.