Now You See Me, Now You Don't: Using LLMs to Obfuscate Malicious JavaScript

Tags

External References

• https://unit42.paloaltonetworks.com/
• https://otx.alienvault.com/

Description

This article discusses an adversarial machine learning algorithm that uses large language models (LLMs) to generate novel variants of malicious JavaScript code at scale. The algorithm iteratively transforms malicious code to evade detection while maintaining its functionality. The process involves rewriting prompts such as variable renaming, dead code insertion, and whitespace removal. The technique significantly reduced detection rates on VirusTotal. To counter this, the researchers retrained their classifier on LLM-rewritten samples, improving real-world detection by 10%. The study highlights both the potential threats and opportunities presented by LLMs in cybersecurity, demonstrating how they can be used to create evasive malware variants but also to enhance defensive capabilities.

Date