Polymorphic AI Malware Is Learning to Evade EDR in Real Time
Malware that rewrites itself per host used to be slow and sloppy. Generative models made it fast, targeted and quiet — and signature-based detection is falling behind.
Polymorphism is old: malware has mutated its own code since the 1990s. What is new is the quality of the mutation. Instead of random packing, current samples use generative models to rewrite their loaders per victim — matching the target's software stack, language locale and even the naming conventions of internal tools. Each sample is unique, and each looks like it belongs.
What changed technically
- Per-host rewriting: the dropper generates a fresh loader on the victim or in the cloud, so no two infections share a hash or a meaningful byte pattern.
- Environment awareness: the malware profiles the endpoint first — installed EDR, sandbox indicators, common processes — and selects a behaviour set that stays under those specific thresholds.
- Living-off-the-land by default: generated stages prefer legitimate tooling and signed binaries, blending into administrative noise.
- Fast iteration: when a variant gets caught, the operators regenerate rather than rebuild, shrinking the window a signature stays useful to hours.
Why signature-based detection loses
A signature is a description of something seen before. Per-host generation guarantees nothing is seen twice. Even behavioural rules strain when the malware deliberately mimics the baseline of the specific host it sits on — the anomaly is designed to look normal *here*, not normal in general.
What defenders are doing instead
1. Detect the outcome, not the artefact
Credential access, unusual child processes of office applications, unexpected outbound connections from servers — the goals of malware are more stable than its code.
2. Hunt on identity and network, not just endpoints
A polymorphic binary still has to authenticate and communicate. Impossible service-account behaviour and novel egress destinations survive any amount of code mutation.
3. Shorten the loop
Assume detection content expires in days. Teams that push new detections weekly are structurally ahead of teams that push quarterly.
4. Control what can execute
Application allow-listing and script control are unfashionable and brutally effective against generated loaders, which cannot anticipate a deny-by-default policy.
You cannot signature your way out of malware that is written fresh for you. Detect what it wants, not what it is.
