The new Linux malware strain, Kosk, has emerged in a striking demonstration of how artificial intelligence is being used to fight cybercrime. In a remarkable development in how cybercrime intersects with artificial intelligence, the malware uses stealthy delivery mechanisms and AI-assisted development to deploy cryptomining payloads.
Koske disguises himself behind seemingly harmless images of pandas and uses dropper techniques and advanced evasion tactics in order to infiltrate target systems using a variety of techniques.
Aqua Nautilus, Aqua Security's threat intelligence team, reports that the malware's code structure indicates a large language model (LLM) influence on its code structure.
It is believed that Koske, a sophisticated Linux threat, has evidently been developed using artificial intelligence tools, as the malware was partially generated or optimised using them. According to Aqua researcher Assaf Morag, "Koske, a sophisticated Linux threat, shows clear signs of artificial intelligence-assisted development."
A new generation of adaptable and highly specialised malware is now available on the market. Koske is characterised by modular payloads, persistent rootkits, and innovative steganographic delivery methods.
Koske represents an entirely new type of malware, able to perform one unique goal: the unauthorised mining of cryptocurrency on a large scale. As discovered by Aqua Nautilus researchers through a honeypot, the malware strain known as Koske combines a unique blend of advanced threat engineering, automation, and artificial intelligence.
According to the Koske cryptominer manual, the application is designed in such a way that it will assess the processing capabilities of the host environment and then deploy GPU-or CPU-optimised miners that are tailored specifically for extracting value from a wide range of digital assets, including Monero and Ravencoin. In his opinion, Koske was almost entirely artificial intelligence-generated, according to Assaf Morag, Aqua Nautilus' Director of Threat Intelligence.
Several indicators within the code itself supported this assessment, such as context-aware, explanatory comments and a structurally consistent, machine-like coding style that was consistent with the underlying code.
Koske stands out from a crowd of malware generated by artificial intelligence in 2025 by providing levels of sophistication that can rival—and in some cases exceed—that of traditional, manually crafted malware strains.
In a brilliant demonstration of deception mixed with technical sophistication, Koske exploits a misconfigured JupyterLab instance exposed to the internet to gain initial system access.
Once the attackers have penetrated the system, they execute remote commands to retrieve two panda-themed JPEG images that have been hosted by legitimate websites like Postimage, OVH Images, and Freeimage that have been compromised.
Although these images may appear harmless, they are in fact polyglot files that conceal executable scripts, allowing them to run arbitrary commands on the host computer as long as they are hidden within the files.
Research by AquaSec suggests that the malware's architecture was shaped by automation frameworks or large language models, which contributed to the malware's modularity and scalability.
After Koske has been executed, it activates both GPU- and CPU-optimised cryptocurrency miners that exploit system resources to mine over 18 digital assets, including Monero, Tari, Zano, Ravencoin, and Nexa, among others. In the future, Koske could evolve to incorporate real-time adaptive capabilities, positioning it as a precursor to a class of AI-assisted cyber threats that are expected to prove more powerful in the future.
As a stunning example of the dual-purpose manipulation of files, Koske uses polyglot files rather than traditional steganography to conceal the malicious payloads, a method that illustrates its technical ingenuity as a hacker. Aqua Security points out that these files are structured in such a way that they can be understood as both valid JPEG images as well as executable scripts, depending on what context they are accessed.
There appears to be no harm in the fact that the files are innocent panda-themed images to the casual user, but upon processing by a script interpreter, the files contain shell scripts and C code embedded within. It is important to note that each image file within the attack chain contains its own payload, which is executed simultaneously upon activation.
It is common for these payloads to consist of C code that is directly written to memory, compiled, and then run as a shared object (.so) file, which functions as a rootkit. In addition to overriding the readdir() function, the rootkit uses LD_PRELOAD to conceal malware-related processes, files, and directories from user space monitoring tools, thereby causing the malware to appear as if it were unrelated to them.
Besides hardcoded keywords like koske and hideproc, the data is filtered using hidden process identifiers located in /dev/shm/.hiddenpid, as well.
In addition to this payload, there is a stealth shell script implemented by hacking native Linux utilities in order to execute it entirely in memory. Through the use of cron jobs that run every 30 minutes and custom system services, persistence is established.
As part of the script, Cloudflare and Google DNS are rewritten into /etc/resolv.conf, chattr +i attribute is added to it, iptables rules are flushed, proxy environment variables are reset, and a custom module is deployed to brute-force operational proxies using curl, wget, and raw TCP calls in order to further enhance operational security.
According to AquaSec researchers, this degree of adaptability, combined with the fact that Koske executes in memory and has a minimal forensic footprint, strongly suggests that automation frameworks or large language models may have been used in the development of the application. Koske's exemplifies how artificial intelligence is playing an increasingly prominent role in cyber warfare as a whole, signalling a significant shift in the cyber threat landscape.
It was observed by Aqua Security analysts that the malware's codebase had several characteristics that suggested an AI-assisted development process. These included verbose scripts with well-commented comments, clean logic structures with a modular approach, and consistent defensive programming techniques. In addition, the malware contains Serbian language strings in some functions, which are likely to have been inserted to obscure the malware's true origin or to make attribution attempts difficult.
In the Aqua team's opinion, Koske may be an early indicator of a bigger trend: a weaponisation of artificial intelligence by malicious actors that could be a larger trend over time. While defenders have increasingly adopted AI as a way of detecting threats and automating processes, adversaries are also beginning to use the same technology to enhance obfuscation, develop polymorphic code, and implement adaptive features that may make it difficult to detect and attribute a cyberattack.
There is an arms race going on between attackers and cybersecurity teams due to the dual-use potential of AI. It is recommended that organisations maintain a proactive monitoring system for shell file changes, unexpected startup behaviours, and changes to DNS configurations or systemd services. Each of these changes may indicate that malicious activity has occurred.
The container security tools should also be optimised so they can prevent rootkit injection as well as block unknown binaries.
In the face of the next generation of malware, Koske stands as a warning not simply of the skillfulness of human hackers but likewise of the increasing influence of artificial intelligence on the next generation of malware, which raises the stakes for security professionals across multiple industries.
The Aqua Security team stresses that organizations must adopt a more proactive and layered defense strategy in light of Koske's advanced capabilities and stealthy infection vectors, as well as adopt a proactive, layered defense strategy.
As a first line of defence, people need to audit and secure all exposed instances of JupyterLab, which is commonly used in Koske campaigns. People also need to disable unnecessary services and enforce robust access controls to protect the environment.
Likewise, it is imperative to continuously monitor system activity for anomalies like executions that take place only in memory, or cron jobs that are unauthorised, or the misuse of native Linux utilities, to establish persistence.
Given that the threat consists of hybrid elements - image files that act as scripts as well as executables - traditional signature-based defences may be insufficient.
It is Aqua's recommendation to deploy behaviour-based detection tools in order to identify suspicious execution patterns. These tools are especially helpful for bypassing disk-based traces, and Aqua recommends doing so.
Furthermore, organisations are advised to revise their incident response plans to accommodate AI-assisted, polymorphic threats such as Koske, which blur the lines between conventional malware and intelligent automation.
Security teams can greatly benefit from integrating these countermeasures to be more equipped in detecting, containing, and neutralising emerging cyberattacks whose intelligence and adaptability are on the rise.
In Koske's opinion, the evolution of cyber threats has reached a critical point, where artificial intelligence, automation, and sophisticated evasion techniques have converged to create malware that is more agile, stealthy, and adaptive than ever before.
Apart from its cryptomining function, Koske also illustrates the shift towards intelligent, modular, and self-sustaining threats that challenge traditional security assumptions in a way that is beyond the scope of crypto mining.
Incorporating polyglot files, memory-resident execution and AI-generated code into attacks demonstrates how attackers are rapidly evolving, leveraging the same technologies that are used by defenders to defend themselves.
The data from Koske indicates that organisations need to take proactive measures to defend themselves against modern threats. They need to be able to detect threats using behaviour-based detection, hardened environments, and proactive monitoring.
As attackers begin to use artificial intelligence more and more industrially, Koske's discovery is only the beginning. This discovery reminds us that in the era of intelligent automation, cyber defence must be equally agile, adaptable, and forward-looking.
