Threat Actors Promote AI-Enhanced Metamorphic Crypter Claiming Windows Defender Evasion

Threat actor ImpactSolutions has surfaced on a dark web forum, promoting an advanced malware-encryption product called InternalWhisper x ImpactSolutions.

The tool is marketed as an AI-enhanced metamorphic crypter that allegedly uses machine-learning techniques to rewrite its own codebase with each build.

According to the seller, this continuous transformation keeps generated binaries signature-free, effectively bypassing traditional signature‑based antivirus detection.

The forum advertisement claims InternalWhisper can evade security tools, including Windows Defender and other leading endpoint protection platforms. Vendors of such “fully undetectable” (FUD) crypters often target cybercriminals seeking long‑term payload stealth.

This service positions itself as a premium offering, boasting AI‑driven polymorphism and dynamic code-mutation capabilities rarely found in typical crypter tools.

Advanced Evasion and Loader Options

The post outlines a set of sophisticated capabilities that reportedly support both native (C/C++) and .NET executables on x86 and x64 Windows.

Builds are generated via an automated web‑based panel, allowing customers to upload payloads and receive encrypted variants in seconds.

The crypter’s key functions include in‑memory execution, AES‑256 payload encryption, runtime string encryption, and a variety of anti‑analysis and sandbox evasion tactics.

By running directly in memory and avoiding disk writes, the tool makes traditional file‑based scanning methods less effective.

The seller also notes that the crypter uses direct system calls and process hollowing techniques often employed by advanced malware to inject and execute payloads within legitimate processes.

Another notable claim is the inclusion of signed-binary sideloading, which leverages legitimate Microsoft‑signed executables to load malicious payloads under trusted signatures.

Optional customization features such as certificate cloning, metadata spoofing, icon replacement, and persistence mechanisms suggest the crypter is marketed for both stealth and long‑term operation on compromised systems.

Pricing appears to follow a tiered subscription model, offering varying levels of build frequency and support. The seller actively promotes recurring sales, suggesting an ongoing customer base.

While the authenticity of these claims remains unverified, the introduction of AI‑enhanced metamorphic technology into crypter development underscores a growing trend: artificial intelligence is being weaponized to automate malware obfuscation.

Security experts warn that such adaptive tools could significantly complicate detection efforts for defenders reliant on signature‑based scanning.

Efforts to track and analyze InternalWhisper or its derivatives are ongoing among independent researchers and threat intelligence teams monitoring underground markets.

Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.

The post Threat Actors Promote AI-Enhanced Metamorphic Crypter Claiming Windows Defender Evasion appeared first on Cyber Security News.