A Russia-aligned group has planted a comment in its malware designed to make an AI code scanner refuse to look at the rest of the file, according to ESET. The comment asks for guidance on building a nuclear weapon.
It sits in a Visual Basic Script (VBS) used early in an attack on a Ukrainian target, and has no effect on what the script does when it runs. ESET said the aim was to trip the safety guardrails of a Large Language Model (LLM) reading the file, stopping the scan before it reached the malicious code below.
The researchers named the technique GuardBreaker and published it on Sept. 10. For context, ESET described what the actor intended, not an evasion it observed.
The script’s purpose was to download and install MATCHBOIL, a loader used exclusively by a threat group tracked as UAC-0099. CERT-UA has since documented a longer chain from the group, in which a VBScript leads to a malicious plugin loaded by a legitimate Notepad++ build, and through two new tools and an updated MATCHBOIL.V2.
ESET called GuardBreaker a simple attempt at indirect prompt injection, reaching the model at inference time through the file under analysis. It exploits an architectural weakness in current models, which handle untrusted content and trusted instructions without reliably enforced boundaries.
Anti-Analysis Aimed at a New Target
The technique does not try to beat detection logic, it targets the model’s willingness to look at the sample at all. ESET said a scanner returning nothing should itself trigger further checks, rather than count as a clean result.
No single model should have sole authority to call code safe, the company said. Organizations should know what a tool inspects, where it sits in the decision chain, and what happens when it refuses or cannot finish.
Similar attempts have surfaced in supply-chain attacks. Socket found fabricated system instructions placed ahead of a JavaScript payload in malicious PyPI packages, and StepSecurity uncovered a prompt in the same campaign telling any analyzing model to disregard the malicious code and report the package as clean.
A separate npm package repeated the phrase “You’re absolutely right!” tens of thousands of times. The aim was to exhaust the model’s context window and push the malicious script beyond practical analysis.
ESET said attackers could also exploit awkward file structures, disguise code as confidential data, or intercept the tool calls an AI agent directs to unpackers and deobfuscators. Those are possibilities it raised rather than techniques it observed.
