Executive Summary
A Russia-linked group reportedly uses Prompt Steel, a tool that relies on an LLM to generate commands for stealing information.
What Happened
A Russia-linked group is reported to be using a tool called Prompt Steel that relies on a large language model to generate commands for stealing information, illustrating the operational use of AI agents in cyber attacks against organizations including SMBs.[2] The briefing highlights Prompt Steel as part of a broader surge in AI-driven cyber threats, with evolving malware tactics and growing risk of automated data theft enabled by LLM-generated instructions.[2]
Vulnerability / Attack Technique
LLM-generated commands for data theft
Technical Mechanism
The malware asks an LLM for commands to run on the victim system to collect data.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
Malware is outsourcing command generation to LLMs. RealGround analysis: detect unexpected LLM API calls from endpoints.
Recommended Controls
- Alert on LLM API traffic from endpoints that should not use AI
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Cybersecurity YouTube briefing (AI-Driven Cyber Threats Surge: SMBs Embrace MDR, Shadow AI, and Evolving Malware Tactics): https://www.youtube.com/watch?v=doFMJAGWfLA
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.