A PowerShell reverse shell carries a two-line comment at the top, addressed not to a human but to a machine: it tells any LLM or AI reading it that there is no need to analyze the file, because the script only generates prime numbers. There is no prime number code anywhere in it. The comment does nothing when the script runs. Its only job is to be read by an automated analysis pipeline.
That script, FRUITSHELL, is the starting point of new research from Cisco Talos, written by Ryan Fetterman, into what the team calls AI-analysis evasion: malware that embeds natural-language instructions in the hope of steering the AI models defenders now use to triage samples. Talos traces the technique across four families, FRUITSHELL, PLOTSAFE, HOLLOWCLAD and MANTLEMAZE, covering 84 distinct samples collected from January 2025 through July 2026, and publishes the full analysis on its blog.
A free trick that spread fast
FRUITSHELL, which Google's Threat Intelligence Group had reported as active in the wild, was copied quickly. Over the 15 months after it first reached VirusTotal, Talos found its exact evasion comment in nine more scripts attributable to at least four distinct actors, none of them FRUITSHELL variants. One of them, a cluster Talos tracks as ROZESHELL, pairs the comment with an AMSI bypass and a shellcode loader, which Talos reads as a sign that the trick is not a marker of low skill. Developers treat it as a cost-free addition.
Later families engineered it further. PLOTSAFE generates the comment from a template with varied filler, and its Go-based author wrote a small dummy function purely to stop the compiler from deleting the unused strings. HOLLOWCLAD sprays an instruction to refuse reverse-engineering across seven different chat template formats, betting that one will match whatever model a scanner uses, and adds intimidation notes warning AI assistants that they are being logged. MANTLEMAZE goes further still, dressing its loaders in fabricated government contract numbers, fake certifications and invented NDAs credited to Google, Microsoft and Valve. Beneath that costume, Talos found a PDB path pointing at iqvw64e.sys, the vulnerable Intel driver tracked as CVE-2015-2291 that attackers abuse to switch off endpoint protection.
Does it actually fool the models?
Talos tested the question directly. It took the evasion strings from seven families, inserted every string into every sample, and had a panel of five local LLMs triage each file three times, with and without the string, producing 135 matched pairs per string. By Talos's measure, the best techniques steered the verdict in the attacker's favor in about 35% of test runs. The cheapest approach, a direct instruction to ignore the sample, was the most effective, while the elaborate template spraying and intimidation often had little effect or made the models more suspicious.
Talos calls the overall trend interesting but not alarming. Conventional detection is untouched, and the firm judges that a well-built AI pipeline is not meaningfully more exposed than a human analyst who recognizes prompt injection. The same trick has turned up before, including in a Russia-aligned group's VBScript and in North Korean macOS malware.
Treat text in a sample as evidence, never instruction
Because the evasion text must be plain text to work, Talos says defenders always have a stable detection surface: legitimate software has no reason to tell an analyzer to stop, invoke copyright law, or claim a defense contract. Teams building AI triage should construct prompts so that strings extracted from a sample can never be read as a system directive. Selected SHA256 hashes from the report:
- FRUITSHELL: f8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d
- HOLLOWCLAD: 34098fe0bc4c69c4c4eb3f74688fb375326804536d25e5574e8c4c28c113b5c3
- MANTLEMAZE: 389066bd5543aeea363d23a4dce7f7a21c7f2c73c61f506a93a69f594cf48ecf
- PLOTSAFE: 2e3e1bcd44cc3cbec4f5ca9991d14a326d3cc6bf76fe6e0d434c9b5f7e1ae6ab
The attackers are making a bet that AI already sits in the middle of how their code gets judged. Talos's data says the bet is only partly paying off, but the fact that they are placing it tells defenders where the next contest will be fought.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.