“It then executes the dynamically generated code within the context of the benign program using Python’s exec() function, with the malicious polymorphic portion remaining totally in-memory,” Sims added. “BlackMamba utilizes a benign executable that reaches out to a high-reputation API (OpenAI) at runtime, so it can return synthesized, malicious code needed to steal an infected user’s keystrokes,” HYAS principal security engineer Jeff Sims wrote in a blog post detailing the threat. The BlackMamba PoC will likely heighten concerns that AI tools can be used by cybercriminals to create new exploits. See the top EDR and antivirus products Leveraging OpenAI In December, SafeBreach Labs researcher Or Yair discovered zero-day vulnerabilities in several EDR and antivirus tools, while in October, the BlackByte ransomware group was found to be actively exploiting a known driver vulnerability to bypass EDR protections. The malware has functionality to steal user credentials, provide shell access, and persist through firmware upgrades.”

While the HYAS researchers may have been wearing white hats, Mandiant researchers this week reported on a “suspected Chinese campaign that involves maintaining long term persistence by running malware on an unpatched SonicWall Secure Mobile Access (SMA) appliance. The malware, dubbed “BlackMamba,” is the latest example of exploits that can evade even the most sophisticated cybersecurity products.

HYAS researchers recently developed proof-of-concept (PoC) malware that leverages AI both to eliminate the need for command and control (C2) infrastructure and to generate new malware on the fly in order to evade detection algorithms.

Anti malware executable