A cybersecurity threat intelligence firm is warning that it has discovered the emergence of the first ransomware sample known to be powered by artificial intelligence (AI).
In a new thread on X, Eset Research says it has uncovered PromptLock, a malware running OpenAI’s GPT-oss:20b model through the Ollama API.
According to the security researchers, the malware generates Lua scripts that scan local files, exfiltrate data, and perform encryption across Windows, Linux, and macOS.
“ESET Research has discovered the first known AI-powered ransomware, which we named PromptLock… Based on the detected user files, the malware may exfiltrate data, encrypt it, or potentially destroy it…
For its file encryption mechanism, the PromptLock ransomware utilizes the SPECK 128-bit encryption algorithm.”
In a notable twist, the ransomware’s prompts hard-code a Bitcoin address linked to Satoshi Nakamoto, the pseudonymous creator of Bitcoin.
“Although the destruction functionality appears to be not yet implemented. Bitcoin address used in the prompt appears to belong to Bitcoin creator Satoshi Nakamoto.”
While ESET does not provide more details on the relevance of Nakamoto’s address, it suggests that the malware is not yet fully operational, as the Bitcoin creator’s address has been inactive since the early days of BTC. Funds sent to that address will likely never be recovered.
The firm echoes the view.
“Although multiple indicators suggest the sample is a proof-of-concept (PoC) or work-in-progress rather than fully operational malware deployed in the wild, we believe it is our responsibility to inform the cybersecurity community about such developments.”
Disclaimer: Opinions expressed at CapitalAI Daily are not investment advice. Investors should do their own due diligence before making any decisions involving securities, cryptocurrencies, or digital assets. Your transfers and trades are at your own risk, and any losses you may incur are your responsibility. CapitalAI Daily does not recommend the buying or selling of any assets, nor is CapitalAI Daily an investment advisor. See our Editorial Standards and Terms of Use.