HUMAN Security VP says AI-written malware shows tidy comments and emojis

What happened

Help Net Security published an interview with Lindsay Kaye, VP of Threat Intelligence at HUMAN Security. She describes how malware written with AI help looks to an analyst and how AI is changing criminal activity (Help Net Security). This is expert commentary. It does not disclose an incident, a new vulnerability or a victim.

According to Kaye, she has not knowingly reverse engineered malware written fully by AI in her current job. She says the closest example would be the VoidLink malware disclosed by CheckPoint. Further details on VoidLink are not confirmed in the source.

Kaye names several signs that a script may have been written by an AI model (Help Net Security):

• Comments that describe each function in a uniform format, sometimes with emojis.
• Logging messages that are similarly structured and use correct spelling and grammar.

She notes that compiled and decompiled code loses comments, and that obfuscation makes attribution harder still. She also cautions that not every piece of code with these features is AI-generated.

Kaye also makes these points (Help Net Security):

• Ad fraud campaigns are larger. In her ad fraud work on mobile apps and HTML5 game sites, campaigns that once involved tens of apps now involve hundreds.
• Patch windows are narrowing. More vulnerability disclosures, combined with a likely quicker path to exploitation, leave defenders less time. She cites the PHP2Shell RCE vulnerabilities as an example that researchers disclosed. Specific CVEs and versions for these are not confirmed in the source.
• AI is helping criminals scale fraud. She lists phishing content, sifting stolen stealer data for session cookies and credentials, and an observed case of an AI agent doing carding-like card verification.
• Account prices have not clearly shifted. She has not seen dark web account prices change in a way she can directly attribute to AI.
• PROMPTSTEAL is a notable case. She calls its use of AI to alter behaviour mid-execution one of the most interesting uses of AI in malware.

Am I affected?

The interview does not name affected products, versions or organisations. It describes general trends, so there is no specific exposure to check against this source.

What to do now

1. Review how long your patch process takes after a public disclosure. Kaye says teams need to respond to the accelerating timelines created by AI-enabled threat actors, though she does not give a set timeframe (Help Net Security).
2. Focus detection on what activity does on the target, not on whether AI was involved. Kaye says the use of AI is interesting context but not usually what helps defence. She points to MITRE ATLAS and published research on threat actor use of AI tools as useful references (Help Net Security).
3. If your team uses AI in threat research, keep a human reviewing conclusions before they are shared. Kaye describes this as her team’s practice (Help Net Security).

Sources

• Help Net Security: What AI-generated malware looks like under the microscope