HONESTCUE malware outsourced stage-two code generation to Gemini

A downloader sent hard-coded prompts to the Gemini API and ran the returned C# to fetch and execute a second-stage payload.

“HONESTCUE is a downloader and launcher framework that sends a prompt via Google Gemini's API and receives C# source code as the response.”Google Threat Intelligence Group

Sources

• GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial UseGoogle Threat Intelligence Group · 12 Feb 2026 · primary source