Google Finds First AI-Developed Zero-Day Bypassing 2FA With Self-Morphing Malware

Google has identified the first artificial intelligence-developed zero-day exploit. The Google Threat Intelligence Group discovered a Python script that bypasses two-factor authentication in a popular open-source web-based system administration tool. This marks a significant shift in cybercrime tactics as attackers begin leveraging large language models to create novel vulnerabilities.

Malware capable of self-morphing source code and generating exploit payloads dynamically detected

The threat landscape now includes malware capable of self-morphing its source code and generating exploit payloads dynamically. Security researchers detected software that modifies its own code and creates decoy code to evade detection. Another notable threat is the PROMPTSPY Android backdoor, which utilizes Google Gemini to manipulate user interfaces. This backdoor takes screenshots, simulates user interactions, and captures PINs or patterns to bypass authentication.

Attackers are increasingly using AI to generate personalized phishing content based on data from LinkedIn and news sources. The technology also enables the creation of deepfake voiceovers and the modification of real video footage for political purposes. Google Threat Intelligence Group noted that while large language models struggle with complex enterprise logic, they excel at contextual reasoning, making them effective tools for these attacks.

Google Threat Intelligence Group highlighted that even the latest models struggle to navigate complex authorization flows. However, their strength in contextual reasoning allows them to be repurposed for malicious ends. The emergence of self-morphing malware and AI-powered backdoors signals a new era of cybercrime where automated systems can identify and exploit weaknesses without human intervention.