Making sure the checks get printed

Cisco Talos has identified a growing trend called 'A3: AI-Analysis Evasion', where malware authors embed natural-language instructions in code to manipulate AI-based analysis systems. These techniques range from simple comments to advanced template spraying designed to deceive large language models (LLMs), with a success rate of approximately 35% in skewing AI verdicts. The evasion methods are used in conjunction with serious threats, such as MANTLEMAZE malware, which abuses vulnerable drivers to disable EDR from kernel space. Since the instructions must be in plaintext, defenders can detect them by monitoring for imperative language in binaries, treating such text as evidence rather than system directives.

AI-extracted · verify before operational use