Lamehug
PROMPTSTEAL, also referred to as LAMEHUG, is a Windows-focused AI-assisted infostealer publicly linked in the provided content to APT28/UAC-0001 (Fancy Bear, Russia’s GRU-linked activity) and used against Ukrainian government, security, defense, and other Ukrainian entities in 2025. It has been described as the first observed APT28 malware and one of the first live malware families to delegate operational logic to a large language model during execution.
The malware was delivered via spearphishing, including emails impersonating Ukrainian government officials and attachments masquerading as AI image or canvas generator applications or legitimate documents. Observed lure filenames included AI_generator_uncensored_Canvas_PRO_v0.9.exe and AI_image_generator_v0.95.exe. Some variants displayed decoy content, including a dropped PDF in C:\ProgramData, while a malicious thread executed the actual payload.
Its defining behavior is querying a live LLM through the Hugging Face Inference API, specifically Qwen 2.5-Coder-32B-Instruct, to generate one-line Windows commands on demand rather than relying on fully hard-coded logic. The generated commands were used for reconnaissance and data theft. Reported commands and behaviors include collecting host information with systeminfo, wmic, whoami, and dsquery; enumerating services with net start; identifying and copying documents from targeted directories with xcopy.exe; and saving collected output to C:\ProgramData\info\info.txt while staging files in C:\ProgramData\info\ for exfiltration.
Exfiltration was performed to adversary-controlled C2 infrastructure either via SSH-based transfer or HTTPS POST requests. A specifically reported HTTPS endpoint was stayathomeclasses[.]com/slpw/up[.]php. The malware also generated DNS activity to router.huggingface.co when interacting with the Hugging Face service.
High-confidence indicators and artifacts mentioned in the content include the malware names LAMEHUG and PROMPTSTEAL; use of Hugging Face / HuggingFace[.]co and router.huggingface.co; the Qwen 2.5-Coder-32B-Instruct model; local staging paths C:\ProgramData\info\ and C:\ProgramData\info\info.txt; decoy PDF placement in C:\ProgramData; and the exfiltration endpoint stayathomeclasses[.]com/slpw/up[.]php. The content consistently characterizes the malware as an experimental but operational AI-enabled stealer used for system reconnaissance, document collection, and exfiltration.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT28 LAMEHUG has sent spearphishing emails impersonating Ukrainian government officials.
Known for blending cutting-edge tools such as the large language model (LLM) ‘LAMEHUG’ with proven, longstanding techniques, Forest Blizzard consistently evolves its tactics to stay ahead of defenders.
„PROMPTSTEAL ist demnach die erste in freier Wildbahn beobachtete Malware, die LLMs abfragt… Um Befehle zu generieren, verwende dieser Data Miner die Hugging Face API…“
Techniques & procedures
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Execution
4 techniques
Execution
LAMEHUG has used the Hugging Face API to query the Qwen2.5-Coder-32B-Instruct LLM to generate one-line Windows commands for the collection of system information and documents in specific folders on compromised hosts. LAMEHUG subsequently executed the returned commands.
Stealth
3 techniques
Stealth
Both malware strains can "dynamically generate malicious scripts, obfuscate their own code to evade detection and leverage AI models to create malicious functions on demand," according to the report.
Discovery
4 techniques
Discovery
The following analytic detects the enumeration of Windows services using the net start command, which is a built-in utility that lists all running services on a system.
"data stolen: system inventories, network layouts, Active Directory hierarchies"
Collection
4 techniques
Collection
Among the malware families in the intro table, LameHug/PROMPTSTEAL is the cleanest example of this route in the wild: it calls HuggingFace’s Inference API for Qwen 2.5-Coder-32B-Instruct to drive reconnaissance and data theft...
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
Command and Control
4 techniques
Command and Control
The dynamically generated commands enable the malware to gather system information and identify sensitive files before transmitting them across the network to an adversary-controlled server.
The content repeatedly describes threat actors, malware, and campaigns using HTTP, HTTPS, HTTP GET/POST, cookies in headers, WebSockets/WSS, and web APIs for command and control or related communications.
Exfiltration
4 techniques
Exfiltration
All of the data and information collected by LAMEHUG malware is exfiltrated to its command-and-control (C2) server.
It uses the Paramiko SSH module for Python to upload the stolen files using hardcoded IP (144[.]126[.]202[.]227) credentials.
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An AI-driven infostealer that queries a live AI model to generate attack commands dynamically.
AI驱动的信息窃取程序，通过查询实时AI模型动态生成攻击指令。
An LLM-assisted infostealer delivered via spear-phishing that queries a legitimate AI model for command generation, then collects and exfiltrates documents.
AI-enabled malware that uses HuggingFace’s Inference API and Qwen 2.5-Coder-32B-Instruct to support reconnaissance, Windows command generation, and data theft.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.