Malware Brief: Trusted Software, AI, and Post-Quantum Ransomware
Barracuda Networks, Thursday, November 5th, 2026
Barracuda's malware brief covers DarkVigil, AI-guided Android malware PromptSpy and Kyber ransomware using post-quantum cryptography.
Barracuda describes three malware families repurposing legitimate technology.
DarkVigil spreads by abusing trusted application functions such as a background promotion feature in Sogou Input Method, then loads modular .NET plugins for cyberespionage.
PromptSpy is the first known Android malware to put generative AI in its execution flow, sending screen information to Google Gemini for click and swipe instructions, though Google has disabled associated assets.
Kyber's Windows variant uses Kyber1024 with X25519 to protect its AES file encryption keys, while its ESXi variant advertises Kyber1024 but uses conventional cryptography, showing capabilities must be verified per variant.