One of the most devious malware strains might have been cracked - and it's all thanks to Gen AI

• Check Point used GenAI to semi-automate reverse engineering of the evasive XLoader infostealer
• AI decrypted code, revealed APIs, and uncovered 64 hidden C2 domains and sandbox evasion tricks
• XLoader evolved from Formbook; AI boosts analysis speed but doesn’t replace human malware analysts

Cybersecurity researchers from Check Point Research may have just cracked one of the most devious malware families to have ever existed, thanks to Generative Artificial Intelligence (GenAI).

In a new blog post, the researchers explained how analyzing malware is a slow, manual process that requires researchers to “unpack binaries, trace functions, and build decryption scripts”. Analyzing XLoader - an infamous infostealer that’s been around for roughly half a decade - is even more difficult, because it cannot be sandboxed.

That’s when Check Point turned to AI for assistance. Using ChatGPT, the researchers combined two complementary workflows: cloud-based static analysis, and MCP-assisted runtime analysis. The first exports data ...