Google Exposes AI Malware in North Korea Crypto Attacks

Google Exposes AI-Powered Malware Behind North Korea’s Crypto Attacks

Written by Aaron S.,

Editor-In-Chief

Last Updated: November 07, 2025

Key Takeaways

Google found that North Korean hackers are using AI tools to modify malware code and steal cryptocurrency from exchanges;
GTIG identified five malware types that use AI models like Gemini and Qwen to create or hide harmful code while running;
One North Korean group, UNC1069, used Gemini to gather wallet data and craft phishing emails targeting crypto workers.

Stop overpaying - start transferring money with Ogvio. Join the waitlist & grab early Rewards NOW! 🎁

BITDEGREE IN YOUR SOCIAL FEED

Google has found that North Korean hackers are using artificial intelligence (AI) to support cryptocurrency theft.

In a recent report, the company’s Threat Intelligence Group (GTIG) explained that several malware programs rely on large language models (LLMs) to write or change code while running.

GTIG said it has observed at least five types of AI-powered malware active in current attacks.

Crypto Fees Explained: How Not to Overpay? (Animated)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Unlike traditional malware, which contains fixed instructions, these new programs can use models like Gemini or Qwen2.5-Coder to create or hide harmful code when needed. This approach, called "just-in-time code creation", lets the malware adjust itself and avoid detection systems.

Two examples from the report, PROMPTFLUX and PROMPTSTEAL, show how attackers are combining AI with hacking operations.

PROMPTFLUX contacts the Gemini API every hour to rewrite parts of its VBScript code, while PROMPTSTEAL, linked to Russia’s APT28 group, uses the Qwen model on Hugging Face to generate Windows commands during attacks.

The report also highlights a North Korean group known as UNC1069, or Masan. According to Google, this group is known for stealing cryptocurrency through social engineering.

Investigators found that UNC1069 used Gemini to look up wallet data, write scripts that reach encrypted files, and create phishing emails in several languages aimed at crypto exchange employees.

Recently, GTIG identified a new tactic used by North Korean hackers, known as "EtherHiding". What is it? Read the full story.