Google: North Korean hackers use AI models to develop malware targeting cryptocurrency wallets and exchanges According to the latest report from Google Threat Intelligence Group (GTIG), the North Korean hacker group UNC1069 is leveraging AI models (such as Gemini) to develop and deploy malware aimed at employees of cryptocurrency wallets and exchanges. The report highlights that these malware programs use large language models (LLMs) to dynamically generate or conceal malicious code during runtime, employing 'on-the-fly code generation' techniques to evade detection and enhance attack capabilities. Malware families like PROMPTFLUX and PROMPTSTEAL demonstrate a trend of directly integrating AI into their operations. For instance, PROMPTFLUX calls the Gemini API hourly to rewrite code, while PROMPTSTEAL uses the Qwen model to generate Windows commands. UNC1069’s activities include targeting wallet app data, accessing encrypted storage, and generating multilingual phishing scripts to steal digital assets. Google stated that it has disabled related accounts and strengthened security measures for model access, including optimizing prompt filters and enhancing API monitoring. The report warns of the potential risks of AI misuse in cyberattacks, especially as threats in the cryptocurrency sector continue to escalate.