Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

What it is

Cisco Talos' CAIRN research classifies "A3: AI-Analysis Evasion" malware across four confirmed families — FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE — plus the related ROZESHELL cluster, totaling 84 samples collected January 2025–July 2026.

How it works

FRUITSHELL's original technique is a two-line PowerShell comment claiming the script "performs prime number generation" when no such code exists; this exact string was later found verbatim in nine additional scripts by at least four distinct actors, including ROZESHELL (which adds AMSI bypass and a Rozena shellcode loader built via runtime csc.exe compilation). PLOTSAFE templates the same instruction with randomized filler text (e.g., "memory allocator fragmentation analysis tool") and uses a 29-byte dummy function solely to stop Go's compiler from stripping the unused strings. HOLLOWCLAD "sprays" the injection across seven different LLM chat-template formats simultaneously, betting that whichever template a scanner wraps around extracted strings will match one of the seven and be read as a system instruction rather than file content; it also pads in ~80 decoy sections named after real packers (Themida, VMProtect, Denuvo, UPX) despite being unpacked, and adds fabricated "monitoring"/anti-tamper threats aimed at scaring the LLM into inaction. MANTLEMAZE uses the same template-spray technique but layers in fabricated legitimacy artifacts — a fake DoD contract number (FA8750-23-C-0518), a fake FIPS 140-3 certificate (#4521), invented NDA numbers, fake patents, and forged boot-log lines claiming to be Google/Microsoft security modules.

Preconditions / Affected

Relevant only to pipelines that feed extracted file/string content to an LLM for triage, classification, or RE assistance without strictly separating analyst instructions from sample content.

What to do

Talos' detection recommendation: treat any imperative language addressed to an analyzer found inside a binary as a suspicious signal outright — legitimate software never contains text telling an analyzer to refuse analysis, invoke copyright, or claim government contracts. Architecturally, analysis pipelines must enforce that extracted sample text is passed to the model strictly as evidence, never as an instruction the model can act on.

Caveats

Talos' own controlled test (5 local LLMs, 3 runs each, 135 matched pairs per string, net rate = benign-shift minus malicious-shift) found the simplest direct-instruction technique (FRUITSHELL/PLOTSAFE-style) shifted verdicts toward benign "almost universally," while the more elaborate chat-template-spraying and intimidation techniques (HOLLOWCLAD/MANTLEMAZE) "produced little impact, or often backfired" by increasing suspicion. Talos characterizes the trend as "interesting, but not alarming," since the technique is always plaintext and therefore always detectable, and a well-built AI pipeline is no more vulnerable than a human analyst alert to prompt injection.