Researchers Uncover New Malware Variants Linked to Midnight Blizzard’s AI-Assisted Cyberattacks
Researchers Uncover New Malware Variants Linked to Midnight Blizzard’s AI-Assisted Cyberattacks
Researchers have uncovered additional malware samples and delivery infrastructure linked to a campaign that Anthropic and Microsoft associate with Midnight Blizzard.
The findings expand earlier reporting on attackers using artificial intelligence to modify malware after security tools detected it.
Starting with two published malware hashes, researchers traced five additional PowerShell stagers, two delivery shortcuts, and connections between phishing domains and servers.
The investigation shows how tracking shared behavior can expose related threats even when attackers change their code.
According to the supplied research, Anthropic reported that the operator used Claude to identify, modify, and redeploy detected implants.
ReversingLabs found evidence consistent with repeated rebuilding, but its telemetry cannot establish whether AI produced individual samples.
The broader campaign targeted more than 20 government, diplomatic, think tank, and defense organizations, mainly across Ukraine and Europe. Attackers also used Microsoft 365 device-code phishing to steal account access.
Midnight Blizzard’s AI-Assisted Malware
The investigation focused on ChocoShell, a PowerShell stager, and CornFlake, a backdoor written in Go. Microsoft previously named both tools in its CaptiveCrunch reporting.
ReversingLabs first observed the backdoor on July 6, 2026, and the published stager on July 10. ChocoShell hides its window, changes PowerShell execution settings, and decodes Base64 instructions before running them.
It collects browser history using code associated with PowerSploit and Empire, examines Windows shadow copies, and performs tasks through background jobs.
The script communicates with 213[.]145[.]86[.]112 over HTTPS. Requests to /t/pixel.gif carry status labels, including stage2_entry and stage2_ctx_, allowing the operator to track execution progress. Microsoft separately described stolen data leaving through /t/event.
CornFlake copies itself into a user directory, creates a registry startup entry, and accesses browser profiles and Microsoft Teams cache data.
Researchers also observed process injection and signals associated with keyboard monitoring. However, ReversingLabs did not observe how this backdoor reached victims or a direct delivery link from ChocoShell.
Two small Windows Internet Shortcut files pointed to stager download locations. Neither contained executable code, and none of 37 antivirus engines flagged them, highlighting the importance of checking where apparently harmless files lead.
Researchers created a YARA hunting rule using the tracking-pixel path, distinctive status labels, and PowerShell execution commands.
It returned seven malicious scripts, including the original sample, five additional stagers, and another related match awaiting further comparison.
The five additional stagers had different hashes but shared an identical profile of 35 capabilities. Similarity analysis separated the scripts into two code variants, while their core collection functions and communication patterns remained unchanged.
Attribution remains qualified. Two additional stagers and both shortcuts had strong infrastructure links to the reported campaign.
Other samples shared the toolset without observed network connections, leaving open the possibility of reuse by another operator.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
