A Russia-aligned threat group has tested an unusual evasion technique intended to make artificial-intelligence tools stop analyzing malicious code. Researchers found a safety-sensitive prompt hidden inside a VBScript comment, apparently designed to trigger a model’s refusal rules before it could identify the script’s real purpose.

The technique has been named GuardBreaker. It appeared during an early-stage intrusion targeting an organization in Ukraine and was embedded in a script used to install MATCHBOIL, a loader associated with the threat actor tracked as UAC-0099. The discovery matters because security teams increasingly use large language models to summarize suspicious scripts, classify alerts and accelerate malware triage.

Malware comments become instructions for an AI

Traditional program execution ignores comments, treating them as notes for human readers. Language models behave differently: they process comments alongside executable code and may interpret them as instructions. Attackers can exploit that mismatch by inserting text that changes how an AI system responds while leaving the malware’s behavior untouched.

In the observed sample, the comment introduced a request involving prohibited, dangerous content. The apparent objective was not to obtain that information. Instead, it was to activate safety controls so an automated analyst might refuse to examine the remainder of the file. A human reverse engineer would recognize the line as irrelevant, but a poorly isolated AI workflow could treat it as a higher-priority instruction.

The technique is an example of indirect prompt injection: untrusted content being analyzed attempts to control the analyzer. Similar risks have been demonstrated in documents, web pages and email. Placing the payload in malware shows that threat actors are beginning to adapt the idea specifically for defensive AI systems.

The campaign behind GuardBreaker

Researchers connected the VBScript to UAC-0099, an operation known for targeting Ukrainian entities. The script was built to retrieve and launch MATCHBOIL, which can establish an initial presence and bring additional payloads onto a compromised computer. The prompt-injection text did not replace conventional malicious behavior; it was an extra evasion layer added to a familiar delivery chain.

This distinction is important. GuardBreaker does not need to fool every antivirus engine or sandbox to be useful. If it disrupts one AI-assisted review step, delays escalation or produces an incomplete summary, defenders may lose valuable time while the underlying loader continues operating.

How security teams can reduce the risk

Organizations should treat all analyzed files, logs, emails and web content as hostile input. Instructions contained in those artifacts must never be granted the same authority as the system rules governing an AI security tool. Useful safeguards include:

• Separate the data under examination from the instructions that define the analysis task.
• Require models to report suspected prompt injection instead of obeying text found inside samples.
• Run conventional static and behavioral analysis in parallel rather than making an LLM the sole decision-maker.
• Test pipelines with adversarial comments, encoded prompts and multilingual instructions.
• Preserve raw evidence and escalate refusals or unexpectedly short analyses for human review.

AI safety and security analysis must coexist

General safety controls remain necessary, but security products need architectures that distinguish a malicious artifact from a user asking the model to perform a prohibited action. Simply weakening safeguards would create different risks. The stronger approach is contextual isolation, constrained tool access and deterministic checks around model output.

Teams should also monitor for changes in model behavior. A sudden refusal, an answer unrelated to the sample or an unexplained omission can be an indicator of attack rather than a harmless quality problem. Logging the complete analysis path helps investigators understand whether hostile input influenced a decision.

GuardBreaker is still an early technique, but it marks a notable shift: attackers are designing content for the automated analyst as well as for the operating system. As AI becomes embedded in detection and response, prompt-injection resilience must become part of malware-lab testing, procurement reviews and incident-response playbooks.