HN

Need help?
<- Back
Malware uses LLMs to rank victims by how much they're worth

Malware uses LLMs to rank victims by how much they're worth

khalidkhair

Comments (108)

  • akersten
    This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.Makes me want to have like 5 separate computers:- one for banking only- one for development only- one for web browsing only- one for gaming only- one for socials onlyHow else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
  • jumploops
    I’ve been thinking about how we’re still in the early days of agents, similar to the early days of the internet, happily opening up our machines and running new protocols.Soon (now?) the threats will become ever more complex, and we’ll be back in the early-2000s-like virus storms.
  • goatsi
    It's an odd choice to run this on the victim's machine (exposing the open router key) rather than on the attacker's infrastructure. I guess this lets them keep it dead simple for buyers, you just need to choose a Telegram channel for the logs to be dumped into.
  • mullingitover
    Are we going to end up in an arms race where our local records are defensively sprinkled with prompt injection/agent poisoning/tank_man.jpg?
  • riskable
    How very considerate! Steal from the rich, not the poor.Conversely, don't bother with poor people!Now we just need proper Robin Hood malware that "levels out the playing field" as it were, by stealing from the rich and moving that money into the poor people's accounts (that have also been hacked).
  • jruohonen
    If you backtrack the posts here, the warnings were there from various bodies already two or three years ago, but it seems the lag is now being closed. (In fact, I wonder why it took so long.)
  • steve1977
    Ha, finally me being poor pays off!
  • markstos
    Once ranked, victims can be assigned a proportional token budget so that a high value victim might be targeted with zero days or deepfakes that are more expensive to execute but have passed the desired cost/reward threshold.
  • anon
    undefined
  • hashmap
    kind of boggles me that the big ai labs arent running zero-shot classification on all their outputs with "does this look like any of these bad things we know people get up to"
  • taytus
    I'm safe.
  • antonvs
    > There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics.This is an old idea just with AI added on top.People even steal physical mail for this reason.
  • geekgod382
    If I ever fall in it's radar, I would be the last on that ranked list
  • ransom1538
    Phase 0: breakins to all (php/python/etc,)Phase 1: the closure, companies close down sites, all banks downPhase 2: the reopen- but to only the correct* sitesPhase 3: the virusesPhase 4: the re-shutdownPhase 5: use of physical currency / fax machines only.We are just getting to Phase 0. By end of 2026 most things will be broken into. By 2027 most banks will be offline.
  • yieldcrv
    now who said enterprises aren’t seeing ROI from AI use
  • MattSharples
    [flagged]
  • READ_A_BOOK
    [dead]
  • 3seashells
    [dead]
  • anon
    undefined
  • thisisauserid
    Good. LLMs aren't very good at that.