Malware uses LLMs to rank victims by how much they're worth

thisisauserid

Good. LLMs aren't very good at that.

akersten

This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software. Makes me want to have like 5 separate computers: - one for banking only - one for development only - one for web browsing only - one for gaming only - one for socials only How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?

riskable

How very considerate! Steal from the rich, not the poor. Conversely, don't bother with poor people! Now we just need proper Robin Hood malware that "levels out the playing field" as it were, by stealing from the rich and moving that money into the poor people's accounts (that have also been hacked).

jumploops

I’ve been thinking about how we’re still in the early days of agents, similar to the early days of the internet, happily opening up our machines and running new protocols. Soon (now?) the threats will become ever more complex, and we’ll be back in the early-2000s-like virus storms.

geekgod382

If I ever fall in it's radar, I would be the last on that ranked list

hashmap

kind of boggles me that the big ai labs arent running zero-shot classification on all their outputs with "does this look like any of these bad things we know people get up to"

ransom1538

Phase 0: breakins to all (php/python/etc,) Phase 1: the closure, companies close down sites, all banks down Phase 2: the reopen- but to only the correct* sites Phase 3: the viruses Phase 4: the re-shutdown Phase 5: use of physical currency / fax machines only. We are just getting to Phase 0. By end of 2026 most things will be broken into. By 2027 most banks will be offline.

steve1977

Ha, finally me being poor pays off!

yieldcrv

now who said enterprises aren’t seeing ROI from AI use

markstos

Once ranked, victims can be assigned a proportional token budget so that a high value victim might be targeted with zero days or deepfakes that are more expensive to execute but have passed the desired cost/reward threshold.

antonvs

> There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics. This is an old idea just with AI added on top. People even steal physical mail for this reason.

jruohonen

If you backtrack the posts here, the warnings were there from various bodies already two or three years ago, but it seems the lag is now being closed. (In fact, I wonder why it took so long.)

mullingitover

Are we going to end up in an arms race where our local records are defensively sprinkled with prompt injection/agent poisoning/tank_man.jpg?

goatsi

It's an odd choice to run this on the victim's machine (exposing the open router key) rather than on the attacker's infrastructure. I guess this lets them keep it dead simple for buyers, you just need to choose a Telegram channel for the logs to be dumped into.