Malware uses LLMs to rank victims by how much they're worth

This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.

Makes me want to have like 5 separate computers:

- one for banking only

- one for development only

- one for web browsing only

- one for gaming only

- one for socials only

How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?

I’ve been thinking about how we’re still in the early days of agents, similar to the early days of the internet, happily opening up our machines and running new protocols.

Soon (now?) the threats will become ever more complex, and we’ll be back in the early-2000s-like virus storms.

Are we going to end up in an arms race where our local records are defensively sprinkled with prompt injection/agent poisoning/tank_man.jpg?

It's an odd choice to run this on the victim's machine (exposing the open router key) rather than on the attacker's infrastructure. I guess this lets them keep it dead simple for buyers, you just need to choose a Telegram channel for the logs to be dumped into.

How very considerate! Steal from the rich, not the poor.

Conversely, don't bother with poor people!

Now we just need proper Robin Hood malware that "levels out the playing field" as it were, by stealing from the rich and moving that money into the poor people's accounts (that have also been hacked).

Ha, finally me being poor pays off!

kind of boggles me that the big ai labs arent running zero-shot classification on all their outputs with "does this look like any of these bad things we know people get up to"

If you backtrack the posts here, the warnings were there from various bodies already two or three years ago, but it seems the lag is now being closed. (In fact, I wonder why it took so long.)

Once ranked, victims can be assigned a proportional token budget so that a high value victim might be targeted with zero days or deepfakes that are more expensive to execute but have passed the desired cost/reward threshold.

If I ever fall in it's radar, I would be the last on that ranked list

I'm safe.

> There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics.

This is an old idea just with AI added on top.

People even steal physical mail for this reason.

Phase 0: breakins to all (php/python/etc,)

Phase 1: the closure, companies close down sites, all banks down

Phase 2: the reopen- but to only the correct* sites

Phase 3: the viruses

Phase 4: the re-shutdown

Phase 5: use of physical currency / fax machines only.

We are just getting to Phase 0. By end of 2026 most things will be broken into. By 2027 most banks will be offline.

now who said enterprises aren’t seeing ROI from AI use

[flagged]

[dead]

[dead]

Malware authors are also software developers, product managers. It's adorable to see them do the things other software developers and product managers do.

Just like it's amusing that Osama bin Laden reviewed Al Qaeda expense report and these expense reports look just like ones anyone else would file.

  Expense: two burgers and fries
  Price: $15.50
  Vendor: Five Guys
  Cost center: SRE, department of evil
  Business purpose: observability meetup, k8s brownbag

Good. LLMs aren't very good at that.