AI-Powered Obfuscated Malicious Apps That Bypass Antivirus Detection to Deploy Payloads

AI-powered threat actors are using heavily obfuscated Python-based loaders and fake security tools to bypass antivirus detection and quietly deploy remote access payloads on Windows systems.

These multi-stage chains abuse legitimate-looking binaries, masqueraded archives, and process injection to maintain stealthy, persistent access.

Multi-stage loaders and fake antivirus setups

In the campaign observed by K7 Labs, the infection begins with a Windows PE dropper embedding an encrypted payload and a runtime decryption routine that reconstructs and writes a batch script, config.bat, to the Public user directory before execution.

This script creates a faux security folder, such as C:DragonAntivirus. It downloads a file from cloud storage that uses a harmless-looking .png extension despite actually being a RAR archive, a simple evasion trick against user scrutiny and basic filters.

Once downloaded, the script leverages the built-in tar utility to unpack the disguised archive.

The extracted contents include a supposed driver file, AsusMouseDriver.sys, which is in reality a password-protected RAR archive; a JSON file renamed and executed as a secondary batch loader; and a legitimate WinRAR executable placed without an extension, all chained together to keep traditional detection at a disadvantage.

Python runtime abuse and stealthy C2

The secondary loader renames the embedded WinRAR utility, then uses it with a hardcoded password to extract a final-stage directory that mimics Windows security components.

Inside, the attackers ship a file named ntoskrnl.exe that is not the Windows kernel but a bundled Python runtime, alongside an obfuscated payload stored as a blob under a Libimage path, while also opening a decoy PDF to divert user attention.

The fake ntoskrnl.exe is launched with specific command-line parameters that trigger a deep de-obfuscation chain within the Python environment: Base64 decoding, BZ2 compression, Zlib compression, and finally marshal loading to reconstruct a marshalled .pyc object in memory.

The resulting 60+ MB blob is mostly filler, with a small valid bytecode segment at the end containing logic to inject into the legitimate Windows binary cvtres.exe, download and map a .NET module into its memory, and then maintain encrypted TCP-based command-and-control suitable for remote access operations.

These techniques highlight how AI-assisted developers and threat actors can rapidly combine multi-layer encoding, archive masquerading, and runtime abuse to create flexible, modular loaders that slip past static signatures.

For defenders, behavioural monitoring of script abuse, unexpected Python runtimes, anomalous use of system utilities such as tar and WinRAR, and unusual .NET modules inside signed Windows processes like cvtres.exe is critical to disrupting these AI-powered obfuscated malicious apps before they can fully establish persistence and C2 channels.

Indicators of Compromise (IOCs)

Hash	Detection Name
675D475B5C02CA834E83BE009E09DB7C (Parent File)	Trojan( 0001140e1 )
33DD6D8FCFF3CA256F44A371FA3CF819 (Injected File)	Trojan( 700000201 )

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates

The post AI-Powered Obfuscated Malicious Apps That Bypass Antivirus Detection to Deploy Payloads appeared first on Cyber Security News.