AI-generated malware and botnets are moving from concept to production

Researchers reported multiple malware and botnet projects that show signs of LLM assistance, including TuxBot v3 Evolution and AI-generated PowerShell reconnaissance code. TuxBot was described as a modular IoT botnet built with AI-generated code and even included safety disclaimers and chain-of-thought remnants in the source. In another case, Huntress found custom PowerShell recon malware apparently generated by an AI assistant to map an Active Directory environment. These stories matter because they demonstrate that AI is lowering the bar for building specialized offensive tooling, even when the code quality is uneven. The implications go beyond malware quality: AI can help attackers iterate faster, adapt to environment-specific defenses, and build more persuasive tooling. Security teams need to anticipate more custom, adaptive payloads rather than just commodity malware.

Sources

• TuxBot v3: The IoT Botnet Built With AI – Bugs, Disclaimers and All — Security Affairs
• TuxBot v3 Evolution Shows Signs of LLMAssisted IoT Botnet Development — Lifeboat — Cybercrime & Malcode
• Attacker Used AI to Build Custom PowerShell Recon Malware — Security Affairs
• Google Gemini CLI abused as a hacking agent, malware botnet operator — Lifeboat — Cybercrime & Malcode