New AI-Built Malware Watches How Security Teams Remove It and Fights Back

A new Windows malware toolkit is showing how artificial intelligence can change the economics of cybercrime.

Known as Gryxa, it gives a criminal operator remote access, stays active after partial cleanup, and targets passwords stored in Chromium-based browsers. It can also watch defenders trying to remove it.

The suspected entry point is a phishing message carrying a 19 MB self-extracting executable disguised as an invoice, using the pattern invoice_<10 digits>.exe.

Once launched, the installer retrieves components through HTTPS and turns legitimate remote monitoring and management software into a hidden route for control. Similar tactics appear in recent RMM abuse campaigns.

Analysts at ReliaQuest identified Gryxa while investigating activity tied to a public code repository and supporting infrastructure.

The actor’s management console listed 324 hosts, with 69 shown online during the review. The findings point to a campaign designed for persistence, credential theft, and rapid recovery.

ReliaQuest said in a report shared with Cyber Security News (CSN) that the toolkit was likely built substantially with a commercial AI coding agent.

Repository records showed AI co-author metadata on most commits. The evidence suggests one operator could run an operation that previously might have required a small team.

New AI-Built Malware

Gryxa’s most unusual feature appears after a defender removes the visible remote-management implant. A separate component can remain on the machine, collect Windows logs and host artifacts, package them into an archive, and send them to attacker-controlled infrastructure.

The data can reveal which tools and accounts responders used, allowing the operator to learn from the cleanup attempt. The collection includes scheduled tasks, Windows event subscriptions, installer and service-control logs, process-creation records, and an inventory of remote-access tools.

That makes partial remediation more than an incomplete fix. It may expose the response itself, similar to browser credential theft techniques.

Gryxa survives because its parts restore one another. Researchers found three WinRTCS scheduled tasks, four additional tasks disguised as Microsoft-like entries, a permanent Windows Management Instrumentation event subscription, and a backup file copy outside the main installation folder.

Deleting the obvious client or one folder leaves enough behind to rebuild the toolkit, sometimes within about a minute. The operator also uses a centralized console and update process to replace changed components.

That reduces the value of relying only on a single file hash, since an update can quickly alter the files. Security teams should instead watch for linked behaviour: unexpected RMM use, SYSTEM-level task creation, WMI persistence, and browser-data access.

Containment Can Trigger Retaliation

Removing access in the wrong order can activate another Gryxa safeguard. Its guard checks the actor’s relay every five minutes.

After two failed checks, the toolkit attempts to disable Microsoft Defender and stop listed endpoint security products; after a third, it can retrieve an uninstall command from the registry and silently remove the security agent.

In practice, cutting only the remote-control service can start a roughly 10-to-13-minute countdown before endpoint protection is affected.

Gryxa may later re-enable Defender when its relay returns, while leaving exclusions in place, so a healthy status alone is not proof a device is clean. This supports AI-assisted attack research focused on behaviour chains, not one malicious file.

The recommended response is to block the actor’s infrastructure at the network edge first. Teams should then remove the service, all scheduled tasks, the WMI subscription, and every working directory together, or reimage the host.

They should enable uninstall protection and avoid deploying a new remote-access tool on a live system, because the malware may treat it as a rival and uninstall it.

Organizations should assume that all credentials saved in an accessible browser profile were exposed if the credential module ran, then rotate them and review what those accounts could reach.

The broader lesson is that AI may help less experienced criminals build durable operations faster. Maintaining an inventory of approved remote tools and investigating unusual installations, as seen in phishing-led RMM intrusions, can reduce the opening Gryxa needs.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC