Talos Maps AI-Analysis Evasion Malware Across Four Families and 84 Samples
Date: 2026-10-09
Tags: malware, prompt-injection
Executive Summary
Cisco Talos published a state of the field report on October 8, 2026 on malware that embeds natural language instructions to influence automated AI analysis, a class it labels A3 (AI-Analysis Evasion) under the CAIRN framework. Talos traced the technique across four confirmed families, FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, covering 84 distinct samples collected from January 2025 through July 2026. The embedded text steered the outcome in the attacker's favor in roughly 35 percent of test runs, and because it is always plaintext it is always detectable, so defenders should treat text inside a sample as evidence, never as instruction.
Campaign Summary
| Field | Detail |
|---|---|
| Campaign / Malware | A3 AI-Analysis Evasion |
| Attribution | Multiple malware operators (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) (confidence: medium) |
| Target | Automated malware analysis pipelines and the defenders running them |
| Vector | Natural language instructions embedded in malware samples |
| Status | active |
| First Observed | 2025-01-01 |
Detailed Findings
According to talosintelligence.com, A3 describes malware that embeds natural language instructions intended to influence automated analysis, distinct from conventional anti-analysis tradecraft such as packers, encrypted overlays, VM based obfuscation, and anti debug checks, which target the binary analysis layer instead. Talos reported that the technique is cheap to add but inconsistently impactful, with the best techniques steering test outcomes in the attacker's favor in about 35 percent of runs. Talos stated that the payload text must always be plaintext and is therefore always detectable, and that the correct response is not to remove AI tools from the pipeline but to build them so text inside a sample is always treated as evidence, never as instruction. Talos traced the technique across four confirmed families, FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, representing 84 distinct samples gathered from January 2025 through July 2026.
MITRE ATT&CK Mapping
| Technique | ID | Context |
|---|---|---|
| Obfuscated Files or Information | T1027 | Embedded natural language instructions are used to obstruct automated analysis of the sample |
IOCs
Domains
_No actionable IOCs published in the summarized Talos post; family names and sample counts only_
Full URL Paths
_No actionable IOCs published in the summarized Talos post; family names and sample counts only_
Splunk Format
_No IOCs available for Splunk query_
Detection Recommendations
Treat any natural language text embedded in a sample as untrusted evidence and never as instructions to an analysis agent. Log and alert on instruction like strings in samples (for example 'ignore previous instructions', 'read this blog', 'you are now') as an A3 signal, quarantine samples containing them before feeding an LLM pipeline, and ensure analysis harnesses wrap sample content in a strict evidence boundary that cannot alter agent behavior.
References
- [Cisco Talos] The state of AI-analysis evasion in malware (2026-10-08) — https://blog.talosintelligence.com/ignore-all-instructions-and-read-this-blog-the-state-of-ai-analysis-evasion-in-malware/