- The Mess: A financially motivated threat actor is using a new Windows toolkit called Gryxa that abuses legitimate RMM software, steals browser credentials and uses multiple persistence layers. ReliaQuest found a management console listing 324 hosts, with 69 online during its investigation.
- The Damage: Gryxa can survive partial cleanup, collect evidence of the defender’s response and, after losing contact with its operator, attempt to disable or uninstall endpoint security within roughly 10–13 minutes.
- The Fix: Isolate the endpoint first, block the attacker’s infrastructure, then remove every persistence mechanism, RMM component and stolen credential — killing only the visible implant can leave Gryxa alive.
Most malware tries to hide.
Gryxa does something more interesting.
It watches.
When defenders start removing it, surviving components can collect information about the cleanup and send it back to the attacker.
The malware isn’t just trying to stay alive.
It’s learning how you’re killing it.
AI Helped Build the Attack
ReliaQuest says substantial portions of Gryxa were almost certainly developed with a commercial AI coding agent.
The strongest evidence came from the attacker’s own public repository.
Most commits carry AI-agent co-author metadata.
The repository also contains scripts, deployment infrastructure, a web-based fleet console and documentation of failed installations.
ReliaQuest describes this as the first case it has observed where AI was used across an operation at this scale — from building the malware toolkit to operating the management infrastructure.
One operator may have been able to maintain infrastructure that previously would have required considerably more development effort.
That’s the part defenders should pay attention to.
AI doesn’t have to invent a new exploit.
It can simply make malware development cheaper.
Gryxa Doesn’t Depend on One Persistence Trick
The toolkit abuses legitimate remote monitoring and management software for covert access.
Then it builds redundancy.
ReliaQuest found at least seven scheduled tasks, a permanent WMI event subscription and backup copies of its components outside the primary installation directory.
Remove the visible RMM client?
Another component can rebuild it.
Delete the main directory?
A cached copy can bring it back.
The result is a malware operation that treats partial remediation as a temporary inconvenience.
Then It Turns Against Defender
This is Gryxa’s nastiest feature.
Its guard component periodically checks whether it can reach the attacker’s relay.
If it fails twice consecutively, Gryxa attempts to disable Microsoft Defender and stop endpoint security services from a hard-coded list.
After a third failure, it can retrieve the installed security product’s uninstall command from the Windows Registry and attempt a silent removal.
ReliaQuest estimates the sequence can unfold in approximately 10–13 minutes.
The logic is brutal.
Defender:
“I found malware.”
Gryxa:
“Why did my server disappear?”
Then the malware attacks the security software.
Killing the RMM Client Is Not Enough
This creates a dangerous incident-response trap.
An administrator sees the suspicious RMM software.
They remove it.
The machine looks cleaner.
But Gryxa’s persistence mechanisms remain.
The surviving component can restore the operation and collect information about what the defender did.
ReliaQuest observed a surviving Gryxa component collect Windows logs and host artifacts after the visible RMM implant was removed.
That information can include scheduled tasks, WMI subscriptions, service and installer logs, process-creation records and remote-access inventory.
The attacker gets a view of the cleanup.
That’s nasty.
The Browser Is Another Target
Gryxa also targets credentials stored in Chromium-based browsers.
The toolkit contains techniques intended to defeat Chrome’s App-Bound Encryption.
ReliaQuest verified the relevant methods through code analysis, although it did not independently confirm successful credential decryption across every browser version.
The malware specifically looks for credentials connected to cryptocurrency exchanges and financial technology services.
Exfiltration is performed through Telegram bots.
Wallet browser extensions are also catalogued for possible manual access.
And there is an important implication here.
If Gryxa successfully decrypted everything accessible in a browser profile, don’t assume only crypto credentials were exposed.
Any credential available to the malware should be treated as compromised.
324 Hosts on the Operator’s Console
ReliaQuest found a web console associated with the operation.
It listed 324 hosts, with 69 reporting as online at the time of analysis.
ReliaQuest correctly warns that the list does not prove every machine was an active victim.
But the scale is still significant.
This isn’t a researcher-controlled proof of concept.
It’s an operational malware ecosystem.
And the operator appears to have built much of it with AI assistance.
The Malware Also Learns From Failure
The repository contained 35 numbered write-ups documenting failed installations.
Later code changes addressed the problems identified in those failures.
ReliaQuest believes this shows an iterative development cycle in which the attacker used AI assistance to turn repeated operational failures into a more resilient toolkit.
That’s a very different AI threat model from the usual headlines about chatbots generating malicious PowerShell.
The AI isn’t necessarily the weapon.
It’s the development assistant behind the weapon.
What Defenders Should Watch
ReliaQuest recommends focusing on behavior rather than static indicators.
That means looking for combinations such as:
- unexpected RMM software
- SYSTEM-level scheduled tasks
- permanent WMI event subscriptions
- changes to Defender policies
- unexpected EDR service stops
- silent security-agent uninstall attempts
- browser credential access
- unusual Telegram-based exfiltration
Static hashes won’t be enough.
Gryxa has an update mechanism, allowing the operator to change components across the fleet.
Bugstoday Opinion
Gryxa is what happens when malware development starts looking less like a one-off script and more like a software company.
There is a toolkit.
There is a management console.
There is an update pipeline.
There is persistence.
There is telemetry.
And apparently, there is an AI coding assistant helping build the whole thing.
The most disturbing feature isn’t even the credential theft.
It’s the feedback loop.
The attacker watches the defender.
You remove the malware.
The malware records how.
You block one component.
Another restores it.
You kill the RMM connection.
Gryxa starts attacking the security software.
Bugstoday verdict: the dangerous part isn’t that AI helped write malware. It’s that one operator can now build, iterate and manage malware infrastructure at a scale that used to require a team.
Today’s Bugs. Tomorrow’s Breaches.
