ESET uncovers AI-powered PromptLock ransomware using OpenAI gpt-oss:20b model, complicating detection with variable Lua scripts.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

YouTube video by Malfind Labs

Oh, look, a use case for OpenAI's gpt-oss-20b model ESET malware researchers Anton Cherepanov and Peter Strycek have discovered what they describe as the "first known AI-powered ransomware," which they named PromptLock. …

Threat researchers discovered the first AI-powered ransomware, called PromptLock, that uses Lua scripts to steal and encrypt data on Windows, macOS, and Linux systems. [...]

Threat researchers discovered the first AI-powered ransomware, called PromptLock, that uses Lua scripts to steal and encrypt data on Windows, macOS, and Linux systems. [...]

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

Researchers raise the alarm that a new, rapidly evolving ransomware strain uses an OpenAI model to render and execute malicious code in real time, ushering in a new era of cyberattacks against enterprises.

　ESETは8月28日、生成AIを利用して悪意あるスクリプトを生成するマルウェア「PromptLock」を発見したと発表した。AIがリアルタイムで悪意あるスクリプトを生成し、感染時には、AIが自律的にファイルを検索・コピー・暗号化する対象を判断するというこれまでにない手法が確認されたといい、同社では、これを「初のAI駆動型ランサムウェア」であり、サイバー攻撃における新たなフェーズの到来を示すものだとしている。

PromptLock malware leverages AI to create Lua scripts for data exfiltration and encryption across Windows and Linux systems.

The invention of PromptLock reveals how malicious use of AI fashions might supercharge ransomware and different threats 26 Aug 2025 • , 2 min. learn ESET researchers have found what they known as “the primary recognized AI-powered ransomware”. The malware, which ESET has named PromptLock, has the power to exfiltrate, encrypt and probably even destroy information, although this final performance seems to not have been carried out within the malware but. Whereas PromptLock was not noticed in precise assaults and is as an alternative considered a proof-of-concept (PoC) or a piece in progress, ESET’s discovery reveals how malicious use of publicly-available AI instruments might supercharge ransomware and different pervasive cyberthreats.

ESET found PromptLock, the first AI-driven ransomware, using OpenAI’s gpt-oss:20b via Ollama to generate and run malicious Lua scripts.

PromptLock створює скрипти Lua, які працюють на всіх платформах, зокрема Windows, Linux та macOS. Загроза сканує локальні файли, аналізує їхній вміст та на