Technical analysis of Promptware and PROMPTFLUX: a new class of malware that queries LLMs mid-execution to evade heuristics and signature-based detection.
What Promptware Actually Does
Promptware is malware that does not ship a fixed decision tree for evasion. Mid-execution, it calls an LLM with context about the host environment, the defenses it sees, and the action it wants next. The model returns natural-language or code-shaped guidance that the malware then interprets and runs. PROMPTFLUX is the same idea pushed further: the model is not a one-shot helper but a recurring planner that can reshape tactics as conditions change.
That design breaks assumptions built into signature and simple heuristic engines. Those systems look for known byte patterns, fixed API call sequences, or static behavioral profiles. If the next step is generated at runtime, the binary on disk may look benign or incomplete until the LLM responds. The threat is less a new exploit class and more a shift in where the logic lives—from the implant to a remote (or reachable) model endpoint.
Why Heuristics Struggle
Heuristic detectors score behavior against expected bad patterns: rapid file encryption, unusual process injection, scripted network beacons with fixed payloads. Promptware can delay, rephrase, or reorder those steps based on what the model suggests for the current host. Two infections of the same family may never share the same command sequence or string constants, so YARA-style rules and shallow behavior graphs age poorly.
Signature catalogs face a related problem. If the "malicious" part is a prompt template plus a thin interpreter, the durable artifact is small and may look like a legitimate automation client. The real payload arrives as free text or generated code after the LLM call. Blocking that requires controlling who may query models from endpoints—not only scanning files after the fact.
Practical Defenses That Still Hold
- Treat outbound LLM and AI-API traffic as a first-class control plane: allow lists, egress inspection, and identity-bound keys on endpoints that do not need model access.
- Monitor for processes that combine local recon (process lists, AV products, OS version) with sudden HTTPS POSTs to model providers, then spawn interpreters or write newly generated scripts.
- Prefer behavioral baselines over pure signatures: unusual parent-child chains, short-lived scripts written from network content, and tools that execute model output without human review.
- Segment and least-privilege service accounts so a compromised host cannot reach model APIs with production credentials.
None of these require knowing a specific PROMPTFLUX build. They follow from the architecture: anything that outsources planning to a remote model leaves a network and identity trail that static scanners never see.
How to Think About This Class Going Forward
Promptware does not obsolete malware analysis; it moves the interesting bits into prompt design, tool use, and the interpreter that turns model text into actions. Analysts should capture full prompt/response pairs when possible, not only the dropper binary. Defenders should ask whether each workload is allowed to call LLMs at all, and whether generated code is ever executed without a human or policy gate.
For builders of detection systems, the useful features are structural: mid-run model queries, environment-conditioned prompts, and execution of returned content. For operators, the useful response is to shrink the blast radius of automated model access and to log those calls with the same seriousness as remote shell traffic. That framing stays valid even as specific Promptware and PROMPTFLUX samples change.