AI helped build Gryxa malware operation, report says

ReliaQuest has identified a malware toolkit called Gryxa that it says was developed with help from a commercial AI coding agent. The security firm linked the toolkit to 324 hosts shown in a management console.

It described the case as the first it has seen in which AI helped build an entire criminal operation, including both the toolkit and the console used to manage it.

According to ReliaQuest, Gryxa was used by a financially motivated threat actor in an initial-access operation. Its conclusion that AI played a central role in development was based largely on metadata from the actor's public code repository, where a commercial AI agent appeared as a co-author on most commits.

The finding adds to a wider cyber security debate over whether AI is changing the economics of online crime by enabling individuals or small groups to produce tools that once required more specialised development work. In this case, one operator appeared to have built and run a toolkit, management console and update pipeline across several hundred systems.

Repository evidence

The actor's repository also contained a rules file supplied to the AI agent in every session, along with handover notes and 35 numbered case studies documenting failed installations. Later commits addressed the problems described in those notes, which ReliaQuest said suggested an iterative development process rather than a one-off generated output.

The researchers also highlighted two scripts carrying the same comment: "Authorized internal deployment - lab/competition scope only." ReliaQuest said neither script matched that description and suggested the wording may have been meant to present the work to the AI model as legitimate testing rather than malware development.

"It is the first case we've observed where AI has helped build the entire operation, from the toolkit to the console the actor runs it from. And for the broader landscape, this likely sets a precedence for more attacks of this nature," ReliaQuest said.

Persistence methods

Gryxa uses legitimate remote monitoring and management software to gain access to compromised machines, then layers multiple persistence mechanisms to remain in place after disruption. ReliaQuest identified at least seven scheduled tasks, a permanent Windows Management Instrumentation event subscription and a duplicate file store outside the main installation directory.

That design means deleting one component will have little effect if the others remain. The researchers said the toolkit was built to restore missing pieces quickly, with some deleted tasks likely to return within a minute.

The malware also steals credentials saved in Chromium-based browsers and checks decrypted results against a list of cryptocurrency exchanges and financial technology services. It separately records the presence of wallet browser extensions, which the report said could allow the operator to return later through remote access and inspect wallets manually.

ReliaQuest said credentials were exfiltrated through Telegram bots rather than the malware's own command-and-control channel. Three bots were reported to the same chat identifier, which the researchers said was consistent with a single-operator setup.

Response visibility

The most unusual feature described in the research was Gryxa's response to attempted clean-up. If defenders removed the visible remote monitoring implant but left other elements behind, another Gryxa component gathered Windows logs and host artefacts showing what had been done and uploaded them to infrastructure controlled by the attacker.

Those records included scheduled tasks and event subscriptions present on the host, installer and service-control logs, process-creation logs, an inventory of remote-access tools on the machine and checks on whether the malware's own communications channel still worked. ReliaQuest said this could reveal the tools and accounts used during remediation.

ReliaQuest said it had not previously seen this behaviour documented in cases involving abuse of remote monitoring software. In one investigation, defenders removed the visible implant, but the toolkit returned within seven days because another component remained active.

Countermeasures

ReliaQuest also said partial containment could trigger attempts to disable endpoint protection. If Gryxa could no longer reach its relay infrastructure, it counted failed connection attempts on disk. After two consecutive failures, the toolkit disabled Microsoft Defender and issued stop and disable commands against named endpoint detection and response products, the researchers said. After three failures, it attempted to silently uninstall the security agent by reading its uninstall string from the registry.

According to the report, that sequence could unfold in roughly 10 to 13 minutes if defenders cut the actor's remote-access service without removing the related scheduled tasks and cached files at the same time. The researchers added that Defender could later be re-enabled automatically once the relay connection was restored, making a healthy antivirus state an unreliable sign that nothing had happened.

Scale and implications

ReliaQuest said the management console visible in the source code showed 324 listed hosts, with 69 online at the time of analysis. It cautioned that not every listed system should be treated as a confirmed victim, but said the compromised host it investigated appeared in that list, linking the repository to the observed activity.

The security firm said the case points defenders toward behavioural detection rather than reliance on file hashes or signatures tied to a single toolkit. Gryxa updates itself by checking an integrity manifest and downloading changed components, allowing the operator to alter files across the estate through a single commit.

The broader concern, ReliaQuest said, was not that the actor showed exceptional sophistication, but that AI may have lowered the barrier to building malware with persistence, recovery logic and operational tooling once associated with a larger team. "What's significant here is that one person likely sustained a workload that would previously have suggested a small team."