Malware That Never Looks the Same Twice — Researchers Say AI Wrote the Whole Thing

Security researchers say they've found a new fileless malware delivery system where artificial intelligence didn't just help write parts of the code — it appears to have designed the entire attack infrastructure from the ground up.

The system, dubbed SpectrePaste, was reportedly uncovered while researchers were digging further into DeepLoad, a credential-stealing campaign first documented back in March that already stood out for its heavy use of AI-generated obfuscation. According to the report, earlier versions of these tools only showed partial AI involvement — bits of code padding here, some obfuscation logic there. SpectrePaste is described as something different: a case where AI acted as the primary architect of the whole delivery system, not just an assistant bolted onto human-written code.

The first version of the tool, which its own operators reportedly called "PasteFast Panel," worked as a centralized dashboard for pushing out PowerShell scripts. Even in this earlier form, the design was apparently sophisticated: the builder automatically bundled in techniques to bypass AMSI — the Windows interface antivirus tools rely on to inspect scripts before they run — and encrypted each finished payload with XOR, so no two delivered payloads looked quite the same. The panel also reportedly included a request-queuing system built to handle a large number of infected machines checking in simultaneously, caching encrypted files in memory and filtering out repeat requests from the same IP to avoid overloading the server, while requests from the operators themselves — like generating a new payload — jumped straight to the front of the line.

The second version is where things get more unusual. Researchers describe it as built using a "spec-driven" approach, where editing a plain-language description of what the tool should do automatically regenerates the underlying code to match. That reportedly turned a simple delivery script into a fileless loader capable of reflective loading directly into memory, paired with a real-time polymorphism engine.

Under this design, every time an infected device checks in, the server is said to assemble a brand-new version of the payload on the spot — pulling random code fragments from an internal library, inventing plausible-sounding function names styled after real Windows system calls, tossing in meaningless filler code, and finally wrapping the whole thing in XOR encryption and Base64 encoding. The result, according to the report, is that antivirus tools relying on known malware signatures largely fail to flag it, since each version is structurally unique. The system's admin panel interface was reportedly also generated by AI rather than built by hand — meaning, if accurate, that AI handled not just the malicious logic but the tool's user-facing design as well.

The researchers behind the report frame the technical details as intended for defenders, not as a how-to guide, and their main takeaway is a shift in strategy: since signature-based detection is losing ground against tools like this, organizations are better off leaning on behavioral analysis and watching for unusual PowerShell activity rather than relying on traditional antivirus scanning alone.