216.73.216.6

Now You See Me, Now You Don't: Using LLMs to Obfuscate Malicious JavaScript

· Published 20/12/2024 15:25 · Modified 20/12/2024 16:41

Export JSON

Essential information

Published
20/12/2024 15:25
Modified
20/12/2024 16:41
Tags
2024-12-20 fraudgpt wormgpt
Related entities
5 observables, 7 techniques (mitre), 2 malware, 1 others

Description

This article discusses an adversarial machine learning algorithm that uses large language models (LLMs) to generate novel variants of malicious JavaScript code at scale. The algorithm iteratively transforms malicious code to evade detection while maintaining its functionality. The process involves rewriting prompts such as variable renaming, dead code insertion, and whitespace removal. The technique significantly reduced detection rates on VirusTotal. To counter this, the researchers retrained their classifier on LLM-rewritten samples, improving real-world detection by 10%. The study highlights both the potential threats and opportunities presented by LLMs in cybersecurity, demonstrating how they can be used to create evasive malware variants but also to enhance defensive capabilities.

External references