APT28 deployed PROMPTSTEAL, malware that queries an LLM for commands, against Ukraine

PROMPTSTEAL posed as an image generator and used an LLM to produce Windows commands that collected system data and documents for exfiltration.

“APT28's use of PROMPTSTEAL constitutes our first observation of malware querying an LLM deployed in live operations.”Google Threat Intelligence Group

Sources

• GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsGoogle Threat Intelligence Group · 5 Nov 2025 · primary source
• CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing CampaignThe Hacker News (quoting CERT-UA#16039) · 18 Jul 2025 · secondary source