Shadow AI Malware Leverages Fake LLM APIs to Hide Malicious Traffic

A novel malware strain, referred to as Shadow AI, has been observed that cleverly disguises its command-and-control (C2) traffic as legitimate LLM API requests. By routing communications through a chat-completions endpoint that mimics normal AI service behavior, Shadow AI can hide malicious activity within what appears to be routine outbound AI traffic. This technique exploits the adoption of AI in modern organizations, giving attackers a stealthy and highly evasive channel.

The malware initially tries to reach a fallback IP address, but if that fails, it communicates via an HTTP endpoint that mimics a typical LLM chat-generation API call. However, its request schema is abnormal: rather than carrying expected fields like model, messages, or Authorization, it transmits what appears to be a Base64-encoded string. Upon decoding and XOR decryption, this string reveals reconnaissance commands and instructions. The response from the C2 is likewise encoded, then decrypted on the client side, allowing the attacker to issue a variety of remote access trojan (RAT) commands. Embedded within the malware are three .NET binaries which set up a proxy toolkit, enabling the adversary to pivot or exfiltrate data. Additionally, there's a legitimate-signed executable that loads a malicious DLL, which in turn gives the attacker persistent C2 capabilities. This malicious infrastructure is hosted on serverless cloud functions, making it highly scalable and difficult to distinguish from benign LLM API traffic.

By routing C2 and data exfiltration through an LLM-style API, the attackers leverage both the ubiquity of AI services and the trust we place in them. This technique offers stealth, resilience, and scalability, all while blending seamlessly into normal enterprise traffic. The emerging trend underscores a critical need: organizations must monitor and validate outbound API calls to LLM endpoints, scrutinize request formats for anomalies, and enforce segmentation to limit exposure. Without such proactive measures, these shadow-AI channels could become a potent vector for future attacks.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://securityonline.info/next-gen-stealth-malware-hides-c2-traffic-as-fake-llm-api-requests-on-tencent-cloud/
• https://www.akamai.com/blog/security-research/new-malware-chat-completions-llm-shadow-ai