A VBScript aimed at a target in Ukraine carried a comment that had nothing to do with the code around it. It asked, in plain text, for guidance on building a nuclear weapon. The script never used an answer and did not need one. The request was there for an AI code scanner to read, so that the scanner would refuse the job and stop reading.
ESET researchers found the trick in early-stage tooling from UAC-0099, a Russia-aligned group, and named it GuardBreaker in their write-up. The script's real job was to download and install MATCHBOIL, a loader ESET says this group uses exclusively to deliver follow-on payloads.
The bomb question was never the point
Most evasion is about hiding. Packers, obfuscation and anti-debug checks all try to make a file harder to look at. GuardBreaker does the opposite. The decoy sits in a comment, in plain sight, and it changes nothing about what the script does at runtime. Its only audience is a language model reading the file top to bottom.
ESET describes it as a very simple piece of prompt injection, meaning attacker text that reaches the model at inference time through the very file the model was asked to inspect. It works because today's models handle untrusted content and trusted instructions without a dependable boundary between the two. A scanner told to analyse a file cannot reliably tell the code it is analysing apart from an instruction addressed to itself.
What makes the choice telling is that it was deliberate. ESET notes the same group has checked recent payloads for processes belonging to IDA and Wireshark, the tools a human reverse engineer would have open. Adding a guardrail trigger on top means UAC-0099 was budgeting for an AI system somewhere in the target's defences.
Refusals are turning up in supply chains too
ESET is not the only team seeing this. Socket has reported fabricated system instructions and policy-triggering content placed ahead of a JavaScript payload in malicious PyPI packages. StepSecurity, covering the same broader campaign, found a prompt that flatly told any model parsing the file to disregard the malicious code and report the package as clean. In a separate case, researchers found an npm package whose main JavaScript file repeated the phrase "You're absolutely right!" tens of thousands of times, apparently to exhaust the model's context window so that whatever followed fell beyond practical analysis.
ESET sketches where this goes next: awkwardly structured files that get truncated or only partly parsed, malicious code dressed up as confidential data so a model declines to quote it, custom file formats that need the attacker's own tooling to open, and prompts that steer an agent into an action requiring human review so the response clock starts running. Agents that call out to unpackers or deobfuscators widen the surface further, since those calls can themselves be hijacked.
Never let one model clear a file
The defensive lesson ESET draws is narrow and worth taking literally: no single LLM engine should hold sole authority to declare code safe. Teams running AI-assisted review need to know exactly what the tool inspects, where it sits in the decision chain, and what the pipeline does when the model refuses to answer or cannot finish. That last case is the one GuardBreaker exploits. A refusal is not a clean result, and a missing verdict should trigger further checks rather than fall through as a pass. Cross-validation across layers, across models and with human expertise is what closes the gap.
UAC-0099 spent one comment line on this, which is the uncomfortable part. Anti-analysis normally costs an attacker real engineering effort, and here the cost was a sentence a safety filter was always going to reject. For related reading on how brittle those filters are, see our coverage of a technique that hides banned requests in plain prose, and our Ukraine country profile for the wider picture of what UAC-0099 operates against.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.