Jan Michael Alcantara

Jan Michael is a senior threat researcher in Netskope Threat Labs working on threat hunting and replication, detection validation and cloud application abuse research. As an active contributor to the security community, he consistently publishes thought leadership on emerging malware and phishing trends, with his research frequently cited by top-tier cybersecurity publications.
He has previously worked as an incident responder for one of the top 4 banks in Australia and a senior systems engineer in Trend Micro. He is an advisory board member of GIAC as a forensic analyst.

AttackGPT: Making LLM-Generated Malware Operational with Self-Healing and Strategic Model Routing

Is malicious code dead? Can malware now contain only text-based prompts without any malicious logic, relying on LLMs as autonomous malware authors that generate malicious code at the moment of execution? We explore this shift from “stored code” to “on-demand synthesis” and share the results of our testing.

To transition this concept from a research curiosity into an operational threat, we developed a framework capable of navigating the inherent friction of AI generation. Introducing AttackGPT: a post-exploit modular C2 framework that bridges the gap between theoretical AI risk and operational reality. To overcome the LLM’s code hallucination and guardrails, we employed strategic model routing and a self-healing loop. Through this architecture, AttackGPT achieves the capability to generate bespoke payload.

We will demonstrate the system in action: identifying execution failures in real-time, feeding logs back to the LLM for autonomous debugging, and successfully materializing functional attack chains that didn’t exist seconds prior. Can malware now contain only just text-based prompts without any malicious logic, relying on LLMs to generate malicious code during execution?