Malware Delivery via Windows Native AI Stack
Summary
Hide ▲
Show ▼
A security researcher has demonstrated a living-off-the-land (LotL) attack that uses Windows' native AI stack to deliver malware. The attack leverages trusted files from the Open Neural Network Exchange (ONNX) to bypass security engines. The method involves embedding malicious payloads in AI models, which are then loaded and executed using trusted Windows APIs. The attack exploits the inherent trust that Windows and security programs place in ONNX files, making it difficult for security tools to detect the malware. The researcher suggests that security tools need to be reworked to monitor AI files and their associated activities. This technique highlights a new vector for malware delivery, emphasizing the need for enhanced security measures in AI-driven systems.
Timeline
-
30.10.2025 21:47 1 articles · 11d ago
Researcher Demonstrates Malware Delivery via Windows Native AI Stack
A security researcher has demonstrated a living-off-the-land (LotL) attack that uses Windows' native AI stack to deliver malware. The attack leverages trusted files from the Open Neural Network Exchange (ONNX) to bypass security engines. The method involves embedding malicious payloads in AI models, which are then loaded and executed using trusted Windows APIs. The attack exploits the inherent trust that Windows and security programs place in ONNX files, making it difficult for security tools to detect the malware. The researcher suggests that security tools need to be reworked to monitor AI files and their associated activities.
Show sources
- LotL Attack Hides Malware in Windows Native AI Stack — www.darkreading.com — 30.10.2025 21:47
Information Snippets
-
Windows' native AI stack can be used as a vector for malware delivery.
First reported: 30.10.2025 21:471 source, 1 articleShow sources
- LotL Attack Hides Malware in Windows Native AI Stack — www.darkreading.com — 30.10.2025 21:47
-
The attack leverages ONNX files, which are trusted by Windows and security programs.
First reported: 30.10.2025 21:471 source, 1 articleShow sources
- LotL Attack Hides Malware in Windows Native AI Stack — www.darkreading.com — 30.10.2025 21:47
-
Malware can be embedded in AI models through metadata, named components, or steganography.
First reported: 30.10.2025 21:471 source, 1 articleShow sources
- LotL Attack Hides Malware in Windows Native AI Stack — www.darkreading.com — 30.10.2025 21:47
-
The attack uses trusted Windows APIs to load and execute the malicious payload.
First reported: 30.10.2025 21:471 source, 1 articleShow sources
- LotL Attack Hides Malware in Windows Native AI Stack — www.darkreading.com — 30.10.2025 21:47
-
Security tools need to be updated to monitor AI files and their associated activities.
First reported: 30.10.2025 21:471 source, 1 articleShow sources
- LotL Attack Hides Malware in Windows Native AI Stack — www.darkreading.com — 30.10.2025 21:47