AI polymorphic malware: how BlackMamba fools antivirus

Researchers at HYAS tested a keylogger against an EDR (Endpoint Detection and Response) solution considered a market leader. The result, reproduced several times: zero alerts, zero detections. The experiment is called BlackMamba, and the trick isn't a sophisticated exploit — it's using artificial intelligence to rewrite the malware itself every time it runs.

What polymorphic malware is

What makes malware "polymorphic"?

Polymorphic malware is malware capable of altering its own code on every execution, keeping the malicious function while changing the "signature" — the pattern traditional antivirus solutions use to recognize known threats. The concept isn't new, but generative AI made producing it far cheaper and far more effective.

How BlackMamba works

BlackMamba is an apparently benign executable that, when it runs, makes a real-time call to the OpenAI API — a high-reputation destination that most security systems don't treat as suspicious. The response to that call is freshly synthesized malicious code: the keylogger functionality, generated on the spot, executed directly in memory through Python's exec() function.

That means the malicious component is never saved to disk as a static file — it exists only in memory, and it's rewritten from scratch on every run. Since each generated version differs subtly from the last, signature-based solutions (comparing the file against a list of known threats) simply have nothing to compare.

The researchers' strategy had two deliberate goals:

• "Clean" network traffic: because the malicious communication disguises itself as a normal call to a popular API, it doesn't show up as anomalous traffic to an unknown command-and-control server.
• An always-new payload: by generating unique code on every run, the AI tries to ensure security solutions never see exactly the same malware twice.

Once active, BlackMamba captures keystrokes — including usernames, passwords and credit card numbers — and sends the stolen data out through Microsoft Teams, using an attacker-controlled channel as the exfiltration destination.

Why this is more worrying than ordinary malware

Traditional malware defense leans heavily on recognizing patterns: file hash, code signature, behavior repeated across earlier campaigns. Malware that rewrites itself on every execution breaks that premise at the root — each victim effectively receives a unique variant.

It's the same underlying logic behind the tools described in the post on WormGPT and FraudGPT: AI doesn't create an entirely new category of attack, it drastically lowers the cost and the technical skill required to pull off an attack that used to demand an experienced malware developer.

How the defense is responding

• Behavioral detection instead of signatures — modern EDR solutions watch what a process does (API calls, keyboard access, exfiltration attempts), not just what the file looks like.
• Monitoring traffic to AI APIs — unusual calls to services like OpenAI from processes that normally shouldn't make them become a warning sign.
• Restricting dynamic code execution — policies that limit the use of functions like exec() in sensitive corporate environments.
• Network segmentation and least privilege — even if the malware escapes initial detection, limiting what a compromised process can reach reduces the damage.

Using legitimate channels such as Microsoft Teams for data exfiltration also reinforces the importance of monitoring anomalous behavior even in trusted corporate tools — traffic volume, unusual destination, off-pattern hours.

The other side of the same technology

It's ironic that the most effective defense against AI-generated malware also comes from AI: behavioral detection systems in modern SOCs use machine learning precisely to identify the kind of anomaly BlackMamba tries to hide — an unusual call to an external API, dynamic code execution, a process that never behaved that way before. Attack and defense are running the same arms race.

It's worth remembering that polymorphic malware isn't the only way AI lowers the technical bar for cybercrime. The same "tool that does the heavy lifting for the criminal" logic shows up in the sale of unfiltered chatbots like WormGPT and FraudGPT, and in the automatically generated phishing described in the post on how AI changed the quality of scam emails.

A proof of concept today, a real threat tomorrow

BlackMamba remains a research proof of concept — it wasn't found actively used in real campaigns at the time of the original publication. But the structural lesson already holds: defense based exclusively on static signatures is living on borrowed time. Companies still relying on traditional antivirus alone, with no behavioral detection layer, are betting against a technology that only gets more accessible every year.