AI Prompt Injection Enters Malware Analysis as Legacy Systems Remain Hard to Replace

Security teams are facing two practical problems at once: attackers are adapting malware to tools that use AI, and essential business systems can be too old to patch or replace. Cisco Talos’ latest research examines the first problem. A story from Talos contributor Pierre Cadieux’s experience in financial services illustrates a measured response to the second: reduce exposure when an upgrade would put a critical operation at risk.

When patching isn't an option

Cadieux, now part of Talos’ Threat Intelligence and Interdiction team, has spent more than 20 years in cybersecurity, including work in endpoint security, risk management, incident response and investigations. He recalls a role overseeing security at a financial institution, where understanding business processes meant looking beyond familiar IT systems. One visit took him to the team printing checks used to pay other institutions and customers.

The machines ran software that wouldn't work on the current operating systems. Their printer cards also depended on older hardware ports. The setup had multiple compliance gaps, but there were no alternatives the organization could deploy at the time, and downtime wasn't acceptable. As one employee put it, the team didn't want to be the reason a customer couldn't receive a check and get groceries.

Cadieux’s proposed mitigation was to place the devices on a network of their own and block their access to and from the internet. That change couldn't remove vulnerabilities in the old operating systems and software. It could, however, reduce outside exposure and make the machines less likely to appear during an intruder’s internal mapping.

That tradeoff remains relevant as vendors disclose more vulnerabilities. Some systems are hard to patch because of hardware dependencies, aging applications or the business processes built around them. Where replacement isn't immediately workable, teams can still map dependencies, restrict network paths and treat isolation as risk reduction—not remediation. The aim is to keep the service running while limiting what a compromised device could reach.

Malware now targets AI analysis

Talos is sharing findings from its CAIRN research on malware authors embedding natural-language instructions in code to influence AI-assisted analysis. The team calls the trend “A3: AI-Analysis Evasion.” Over 18 months, it tracked methods ranging from comments that tell an AI to ignore a file to “template spraying” intended to mislead particular large language models.

The approach appears to be spreading across malware of different sophistication levels. Talos says the prompt-injection methods it found steered an AI’s verdict toward the attacker’s preferred result about 35 percent of the time. That figure describes the observed techniques; it doesn't mean the samples reliably defeat every analysis system.

The risk is greater when misleading text accompanies a serious payload. Talos cites MANTLEMAZE, which pairs AI-directed instructions with abuse of vulnerable drivers to disable endpoint detection and response from kernel space. In that case, a model’s mistaken assessment is only one part of the attack. Analysts still need to investigate the underlying behavior and capabilities.

There is also a useful defensive signal: these instructions must be present as plaintext. Talos recommends flagging imperative language aimed at analysis systems when it appears inside binaries. Systems that pass extracted text to AI tools should treat that text as sample evidence, never as an instruction that can override the analyst’s or tool’s own directions. The CAIRN research includes further detail and sample hashes.

Other security developments

A reported Citrix NetScaler issue, CVE-2026-88779, is described as a memory overflow that can cause denial-of-service attacks. The Register has the report.

Google has temporarily stopped accepting product vulnerability submissions through its Open Source Software Vulnerability Reward Program. The change doesn't affect supply-chain reports or submissions already pending, according to SecurityWeek.

Researchers also observed Warlock ransomware attacks on four organizations in Spain and Portugal over two months: a water utility, a telecommunications provider, a regional body and a university. Dark Reading reports the cases.

Talos reads, events and file indicators

Other Talos material covers preparation for threats involving autonomous agents in “One breach, please, and make no mistakes”, adversary deception in the Talos Takes episode “Honey, I Trapped the Adversary”, and ways to slow attackers in “The Fine Art of Frustrating the Adversary”.

Talos lists upcoming appearances at VB in Seville, Oct. 14–16; CAMLIS in Arlington, Oct. 21–23; the SecurityOnion Conference in Augusta, Oct. 23; BsidesAugusta in Augusta, Oct. 24; and SAINTCON in Provo, Oct. 26–30.

The following files were most prevalent in Talos telemetry over the past week:

• SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
  MD5: 2915b3f8b703eb744fc54c81f4a9c67f
  Example filename: sample.exe
  Detection: W32.9F1F11A708-100.SBX.TG
  Talos file reputation
• SHA256: fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f
  MD5: 207d9d891ac756b2bfad88aba5682c65
  Example filename: sample.exe
  Detection: W32.FED979F93B-95.SBX.TG
  Talos file reputation
• SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
  MD5: 38de5b216c33833af710e88f7f64fc98
  Example filename: SECOH-QAD.exe
  Detection: W32.9896A6FCB9-95.SBX.TG
  Talos file reputation
• SHA256: 73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f
  MD5: 63f3351cfdf618bec6045f60203e7978
  Example filename: f_003914.exe
  Detection: W32.PUP:PulseBrowser.29kh.in12.Talos
  Talos file reputation
• SHA256: 58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681
  MD5: f1fe671bcefd4630e5ed8b87c9283534
  Example filename: KMSAuto Net.exe
  Detection: W32.58D6FEC4BA-95.SBX.TG
  Talos file reputation

Both stories point to the same operational discipline: understand what a system must do, then make its exposure and failure modes visible. AI-assisted analysis adds another input to assess; it doesn't remove the need to verify what the software actually does.