Unit 42: Real-World Prevalence of 405 AI-Related Malware Samples and Evaluation of Existing Defenses

1. Basic Information

• Article Title: The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution
• Publisher: Unit 42
• Publication Date: 2026-08-25
• Original Source: Unit 42
• Related Sources: None
• Related Technologies, Products, and Datasets: 405 unique SHA-256 hashes, Cortex XDR, WildFire, VirusTotal Intelligence, public OSINT
• Severity: High (Evaluated for research value to read real-world operational risks of AI malware quantitatively, rather than for emergency response)
• Report Type: defense_research / telemetry_prevalence_study

2. Key Takeaways

When Unit 42 checked 405 AI-related samples against Palo Alto Networks telemetry, they found only 12 samples (3.0%) on non-test Cortex XDR protected endpoints. All 12 samples generated XDR alerts. Unit 42 states that its products detected and blocked all samples that tried to reach customer environments.

Meanwhile, about 97% of the samples did not appear in the company's real-world customer telemetry. They stayed in research repositories, sandboxes, and security testing environments. However, this 97% does not mean that "97% of AI malware in the world is not used in the real world." This is only a result limited to a selected dataset of 405 hashes and the time period and customer environments that Palo Alto Networks can observe.

3. What the "405 Samples" Mean

The 405 samples are not only "malware that uses AI as a runtime feature." Unit 42 intentionally used a broad collection standard. The samples include:

• Malware that actually includes LLMs or agent features.
• Code that is evaluated as created with LLM support.
• Samples that use AI for distribution or social engineering.
• Traditional malware that simply abuses AI product names or "ChatGPT" as filenames or brands.
• Research PoCs, BAS (Breach and Attack Simulation) / security testing, and researcher submissions.

Therefore, it is important not to narrowly interpret the total number 405 as "405 pieces of AI-driven malware."

4. Observation Period and Measurement Method

Data Sources

• WildFire analysis reports.
• VirusTotal Intelligence.
• Public OSINT research.
• Endpoint telemetry in non-test Cortex XDR tenants.
• Sessions sent to WildFire from Next-Generation Firewalls or Cortex XDR.
• Cortex XDR alerts and WildFire verdicts.

Observation Period

• Endpoint presence: December 2024 to June 2025.
• Network visibility / WildFire sessions: June 2024 to June 2025.

The article was published on August 25, 2026, but the real-world telemetry observation window ends in June 2025. This time gap is an important constraint when interpreting the results.

Measurement Method

The study checked 405 known SHA-256 hashes against multiple telemetry sources. For the hashes found in the real world, it performed additional analysis on malware families, distribution methods, detection factors, and blocking results. This is a retrospective prevalence study starting from known hashes, not a study to discover unknown hashes comprehensively.

5. Main Results

"12/12 alerts" does not mean "100% detection of all AI malware in the world." The former is the result for the 12 hashes encountered in the company's endpoint telemetry out of the 405 selected hashes.

6. The 12 Samples Confirmed in the Real World

Unit 42 organizes the 12 samples into five major patterns:

• FunkSec ransomware: Seven variants. They share a Rust codebase and show traditional ransomware behaviors like disabling Windows Defender, deleting Volume Shadow Copies, and changing the desktop wallpaper.
• Trojanized AI application / Recipe Lister: An NSIS installer disguised as an AI app. Observed in over 50 organizations, generating over 6,500 endpoint profile records and 9,600 XDR alerts. According to Unit 42, no successful execution occurred on protected endpoints.
• Oyster / CleanBoost: A distribution and sideloading-type backdoor disguised as legitimate software.
• Rhadamanthys: An info-stealer malware. Included in the collection targets as part of an AI-related infection chain.
• COM hijacking DLL: A DLL distributed with an AI-brand lure, implementing persistence via COM hijacking.

Here too, "whether AI is a core runtime feature," "whether it was developed with AI support," and "whether the AI brand was merely used for distribution" are not the same thing.

7. The Approx. 97% Not Confirmed in the Real World

Unit 42 mainly organizes these into three categories:

1. Proof-of-concept / research code: Code for research and demo purposes.
2. Security validation / testing: Samples intentionally introduced for BAS or internal verification.
3. AI-themed brand abuse: Samples using AI product names or brands, but the payload itself is traditional malware.

This separation is important to avoid interpreting the number of samples existing on VirusTotal and similar platforms directly as the "number of real attacks."

8. What Existing Defenses Worked

Unit 42 reports that for the samples that reached the real world, existing multi-layer defenses were effective, rather than new AI-specific detection methods.

• Execution and verdicts in sandboxes.
• Behavioral analysis.
• Anomalies related to code signing, such as code signers that are rare within the organization.
• File characteristics such as high entropy.
• Traditional behaviors on endpoints such as processes, persistence, and defense evasion.

The important point is that they were stopped not because the system directly judged "whether it was made using AI," but because the generated binary or execution chain appeared on traditional detection surfaces.

9. What This Study Can and Cannot Tell Us

What It Can Tell Us

• In the 405-hash dataset, encounters in Palo Alto Networks customer real-world telemetry were limited.
• All 12 hashes observed on non-test Cortex XDR endpoints generated alerts.
• Counting research, testing, and AI brand abuse in the same category as "live operational AI malware" leads to misreading the reality.
• At least in this dataset, existing defenses such as behavior analysis and sandboxes were effective.

What It Cannot Tell Us

• That 97% of all AI malware in the world is non-operational.
• That the same prevalence and detection rates apply outside of Palo Alto Networks customers.
• That activity from July 2025 through August 2026 has the same ratios.
• That unknown hashes or AI-related malware not included in the collection targets can be caught with the same accuracy.

10. Constraints and Limitations

• The population is 405 known SHA-256 hashes, not a random sample from all malware in the world.
• The definition of AI relation is broad, mixing AI features, AI-assisted development, and AI brand abuse.
• Real-world telemetry depends on Palo Alto Networks' customer and product coverage.
• The observation period ends in June 2025, which is about 14 months before the article's publication date of August 2026.
• Hash matching may miss unknown variants or rebuilt versions with the same functions.
• Because it includes the vendor's own product telemetry and product evaluation, detection rates cannot be directly generalized to other products.

11. What Metrics to Use in a SOC

Instead of tracking a single number for "number of AI malware instances," it is more useful to separate the following:

• Number of samples confirmed in public repositories.
• Number of samples encountered in your own organization.
• Number of instances where execution started.
• Number of instances alerted by defense products.
• Number of instances actually blocked.
• Number of instances that bypassed defenses and succeeded in execution, persistence, and information theft.
• Whether AI is a runtime feature, development support, or brand abuse.

This helps avoid overly increasing priority just because of an "AI" label, while tracking changes in actual successful compromise rates and iteration speed.

12. Facts / Inference / Hypothesis

Facts

• Collected 405 unique SHA-256 hashes from WildFire, VirusTotal Intelligence, and public OSINT.
• Confirmed 12 instances (3.0%) in non-test Cortex XDR endpoint telemetry, and all 12 instances generated alerts.
• Confirmed about 15 to 20 instances (about 4%) in WildFire sessions.
• About 97% were not confirmed in the company's customer real-world telemetry.
• The endpoint observation period is from December 2024 to June 2025, and Network/WildFire is from June 2024 to June 2025.
• Unit 42 reports that its products detected and blocked all samples that attempted to reach customer environments.

Inference

• Explaining the operational scale of AI malware using only the number of public samples tends to overvalue the threat by mixing in research PoCs, testing, and brand abuse.
• In current SOC operations, prioritizing runtime behavior and evidence of successful compromise is more practical than focusing on the "AI usage judgment" itself.

Hypothesis

• If AI assistance increases the speed of generating variants, the workload for analysis, clustering, and rule maintenance may increase, even if existing detections function properly.

13. MITRE ATT&CK Mapping

This article is a prevalence study across multiple families and its main purpose is not to show TTPs of a specific campaign. Therefore, MITRE ATT&CK is not assigned to the report as a whole. Map it per family when investigating individual malware.

14. Unknown Points and Further Research

This article does not clarify how well the selection process of the 405 samples represents all AI-related malware globally, what the appearance rate is outside of Palo Alto Networks customers, how conditions changed after July 2025, or what the detection rate is including unknown hashes.

15. Impact on Global Security Operations Centers (SOCs)

In SOC operations, rather than raising priority simply because of the term "AI malware," it is more effective to separately measure real-world encounters, execution, blocking, and successful compromises. When explaining public sample counts to management, it is also necessary to separate research PoCs, testing, AI brand abuse, and live operational samples.

16. Summaries by Target Audience

• For SOCs: Rather than rapidly increasing AI-specific signatures, maintain existing behavioral detection, sandboxes, and evidence of successful execution, while clarifying the denominator and observation period for AI-related KPIs.
• For Administrators: Check EDR/sandbox coverage, blocking results, and unmanaged endpoints, and subject software bearing AI brands to the same software trustworthiness evaluation as any other software.
• For Users: Safety is not guaranteed even if software has an AI product name or a seemingly legitimate signature; always verify official distribution sources and organizational permissions.