A newly discovered cryptominer suggests that attackers are not only using artificial intelligence (AI) to develop malware from scratch but also to create code that exceeds the capabilities of human-generated malware.
Recently, researchers from Aqua Nautilus caught a new Linux malware in a honeypot, which they named "
Koske." It's a cryptominer by trade, designed to identify the capabilities of the computer it infects, then run miners optimized to earn any one of 18 different cryptocurrencies, including Monero and Ravencoin.
According to Assaf Morag, director of threat intelligence at Aqua Nautilus, running Koske through an AI detection tool revealed it to be essentially 100% AI-generated. Even a cursory review of its code made this conclusion obvious: There are
AI-ish comments interspersed throughout, which explain what each part of the code does, and the structure of the code itself has a certain artificial je ne sais quoi.
And while in 2025
AI malware is no longer so shocking, what stands out about Koske is that it also happens to be sophisticated — in some ways more sophisticated than all but the best human-written malware.