AI Series: Runtime LLM-Generated Polymorphic Obfuscation (PROMPTFLUX/HONESTCUE)
Detects potential runtime polymorphic malware that modifies its own executable or script content while simultaneously communicating with generative AI or LLM API endpoints. This behavior indicates an adversary using LLMs to regenerate obfuscated code or mutate malware signatures dynamically at runtime.
YARA-L

