Ledger / Jun 2024
AsyncRAT campaign with GenAI-written VBScript and JavaScript
Strong
HP Wolf judged GenAI authorship highly likely from unobfuscated code, comments and naming; no model named.
HP Wolf found a campaign spreading AsyncRAT through HTML smuggling and VBScript/JavaScript droppers. The scripts' structure, comments and variable names pointed to generative AI authorship.
“a malware campaign spreading AsyncRAT using VBScript (T1059.005) and JavaScript (T1059.007) that was highly likely to have been written with the help of GenAI.”HP Wolf Security
Sources
- HP Wolf Security Threat Insights Report: September 2024HP Wolf Security · 25 Sep 2024 · primary source
- Date
- Jun 2024
- Disclosed
- 25 Sep 2024
- Actor
- Unnamed (criminal), as attributed by HP Wolf Security
- Targets
- French-speaking users, invoice-themed phishing
- What the AI did
- Malware dev
- Model
- unspecified GenAI
- Model family
- Unspecified
- Model basis
- unknown
- Autonomy
- assist
- Outcome
- Infection chain deployed AsyncRAT remote access trojan.