Russia-aligned operators are testing a new way to make artificial intelligence overlook malicious code. The technique, called GuardBreaker, hides a safety-sensitive request inside an otherwise ordinary script comment, hoping that an AI code scanner refuses to continue its work.
The activity was observed during an early-stage intrusion against a target in Ukraine. The VBScript was built to download and install MATCHBOIL, a loader associated exclusively with the UAC-0099 group and used to bring further payloads onto compromised systems.
Researchers at Welivesecurity, the research publication of ESET, identified the tactic in a UAC-0099 script. The comment sought guidance on building a nuclear weapon, content designed to activate a model’s safety controls.
ESET said in a report shared with Cyber Security News (CSN) that the finding matters because AI is now routinely used to sort suspicious files and support malware investigations.
If an attacker can make a scanner abandon a file before it reaches the harmful instructions, teams may lose time or wrongly treat a dangerous sample as benign.
Russia-Aligned Hackers Use GuardBreaker Prompt Injection
GuardBreaker does not alter what the VBScript does when a victim runs it. Instead, the hostile text is placed where an analyst or an automated tool can read it, turning the act of inspecting the file into the target of the attack.
This is a form of prompt injection: untrusted content inside a file reaches a language model while it is being analysed. The model may struggle to separate that content from valid instructions, especially when its guardrails are designed to stop responses involving dangerous or prohibited subjects.
In this case, UAC-0099 appears to have planned for AI-assisted defences alongside more familiar checks for analysis tools, including IDA and Wireshark.
The group has already relied on phishing-led delivery and the MATCHBOIL family, as covered in UAC-0099 MATCHBOIL loader campaign, making the new comment-based tactic a notable extension of its evasion playbook.
The approach is simple, but its potential effect is significant. A scanner that returns no result, or stops with a safety refusal, can create a blind spot if a workflow interprets the missing assessment as harmless rather than as a reason to investigate.
Such attacks exploit a weakness: they mix attacker-supplied material with analysis instructions. That boundary can fail when comments look harmless and stay inert during execution.
The concern reaches software supply chains, where malicious packages have included policy-triggering prose or repeated language intended to consume a model’s context and hide payloads.
Why Defenders Must Verify AI Results
The case shows why an AI model cannot be the sole authority on whether code is safe. Security teams should map exactly what each AI-assisted tool reads, where it sits in the decision process, and what procedures start when the tool fails, refuses, truncates content, or cannot finish analysis.
Analysts should cross-check AI findings with other engines, conventional static and behavioural analysis, and human review.
That layered approach is especially important as prompt injection risks are affecting more than malware triage; enterprise LLM prompt injection risks show how crafted language can also influence broader AI-enabled business systems.
Teams should treat unusual file structures, excessive repeated text, and instructions aimed at the reader or model as suspicious context, not trusted guidance.
A related AI summary prompt attack illustrates how hidden or repeated content can steer automated interpretation away from what a human user expects to see.
AI agents that can call unpackers, deobfuscators, or other external tools need added safeguards because those connections broaden the attack surface.
Restricted permissions, careful review of tool calls, and escalation of incomplete results can reduce the chance that a manipulated analysis process becomes a route to malware delivery or execution.
For organizations without round-the-clock analysts, the essential point remains the same: prevention must connect to detection and response.
A suspected file should be examined alongside activity elsewhere in the environment, so one model’s refusal never becomes the final word on a possible intrusion.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
