Back to today’s briefing

Story perspectives

New AI Ransomware 'PromptLock' Targets Windows, macOS, Linux

8/28/2025

39 5

Summary

Story summary

ESET identified "PromptLock," the first AI-driven ransomware that creates malicious scripts using OpenAI's GPT-OSS model via the Ollama API.
This malware is a proof-of-concept and affects Windows, macOS, and Linux systems.
PromptLock can enumerate files, exfiltrate data, and encrypt files with the SPECK 128-bit algorithm.
ESET advises monitoring unusual Lua script executions and inspecting outbound connections to mitigate risks.

1 of 1

Story summary

ESET identified "PromptLock," the first AI-driven ransomware that creates malicious scripts using OpenAI's GPT-OSS model via the Ollama API.
This malware is a proof-of-concept and affects Windows, macOS, and Linux systems.
PromptLock can enumerate files, exfiltrate data, and encrypt files with the SPECK 128-bit algorithm.
ESET advises monitoring unusual Lua script executions and inspecting outbound connections to mitigate risks.