Hackers Are Now Trying to Scare the AI
Cyber attackers have found another unusual way to hide malware: convincing the artificial intelligence analysing it that it would rather not look.
Russia-aligned threat group UAC-0099 has been observed using a technique researchers have named GuardBreaker. Instead of simply attempting to hide malicious code through encryption or obfuscation, the attackers added deliberately sensitive text to a malicious VBS script.
The idea is surprisingly simple. If an organisation feeds suspicious code directly into a large language model for analysis, certain words or requests may trigger the AI’s safety controls. Rather than continuing to analyse the code, a poorly designed system could refuse the request altogether.
Essentially, the malware is trying to get itself moderated.
What the Malware Actually Does
Behind the distraction, the VBS script is designed to install MATCHBOIL, a C#-based loader previously associated with UAC-0099.
The group has been linked with attacks targeting organisations in sectors including transport and energy, with this particular activity directed towards Ukraine.
This is not the first time attackers have tried manipulating security tools powered by AI. Similar prompt-injection techniques appeared during software supply-chain attacks earlier in 2026, where malicious packages contained text intended to confuse automated LLM-based security scanners.
Why It Matters
AI can significantly speed up malware analysis, but it should not become the only pair of eyes in the security operations centre.
Security systems need to treat anything contained inside suspicious files as untrusted data, not instructions for the AI itself.
Combining traditional static analysis, sandboxing, behavioural monitoring and human investigation with AI-assisted analysis gives attackers fewer opportunities to exploit a single weakness.
AI might be joining the cyber security team, but apparently the attackers have already started sending it suspicious emails.