Polymorphic and metamorphic malware: what they are, how they evolved and how to detect them

Polymorphic malware changes its appearance with each copy, usually by encrypting its body differently and generating a different decryptor, while the code that runs stays the same. Metamorphic malware rewrites the instructions of its body in every generation, leaving no constant core. Both aim to leave no fixed fingerprint for an antivirus engine to recognise.

The idea is more than 35 years old and has returned to threat reports with generative AI. In November 2025, Google Threat Intelligence Group described PROMPTFLUX, a VBScript dropper that asked the Gemini API for fresh obfuscation techniques so it could modify itself "just in time" and slip past static signatures. Google classed it as experimental and its self-update routine was switched off.

What is polymorphic malware?

MITRE ATT&CK has listed it since October 2024 as sub-technique T1027.014, Polymorphic Code, under Obfuscated Files or Information (T1027). It defines it as code able to change its runtime footprint, mutating with each execution into a different version that achieves the same objective. Since version 19 in April 2026, T1027 sits under the Stealth tactic.

Carey Nachenberg of Symantec described the classic mechanism in a 1996 paper. Plain encrypted viruses kept the same decryptor from one generation to the next, and antivirus software soon learned to look for it. A polymorphic virus adds a mutation engine that generates a different decryption routine with each infection. That routine runs first, decrypts the body in memory and hands over control, so that, as NIST SP 800-83 put it in 2005, encryption alters only the code's appearance.

Packers and crypters (T1027.002, Software Packing) achieve a similar effect from outside the code. They compress or encrypt the executable, change its hash and byte patterns, and rebuild the program in memory at launch. Virtualisation-based protectors such as VMProtect or Themida go further and translate the code into a format that only an interpreter embedded in the binary can run, according to MITRE. Legitimate software uses them too, so flagging the protector or a high-entropy section produces false positives unless it is combined with prevalence and behaviour.

How does metamorphic malware differ from polymorphic malware?

Metamorphic malware does not hide its body behind encryption but rewrites it. Peter Ször and Peter Ferrie, researchers at Symantec, wrote in "Hunting for Metamorphic" that metamorphic viruses have neither a decryptor nor a constant virus body, although some of the best-known ones, such as Zmist and Simile, paired the metamorphic body with a polymorphic decryptor.

To get there, the engine disassembles the code, converts it to an intermediate form and reassembles it with equivalent instructions, swapped registers, reordered blocks and junk code that leaves the result unchanged. Some engines also shrink the code so that it does not grow without limit.

Terminology is not consistent. MITRE treats "metamorphic" as a synonym of polymorphic in T1027.014, while the 2005 NIST guide and the antivirus vendors' literature keep them apart. For detection the distinction matters, because polymorphic code eventually reveals a constant body once decrypted and metamorphic code has none.

The table orders the variants in this family of techniques from the simplest to the most recent.

How is polymorphic malware detected?

A classic signature looks for a hash or a byte pattern, with wildcards, and polymorphic malware changes both with every copy. The antivirus response in the 1990s was emulation, which Symantec called generic decryption. The scanner runs the file inside an isolated virtual computer until the decryptor exposes the body, and then searches for the signature.

Emulation is still inside current engines. At Black Hat USA 2018, Alexei Bulazel presented his reverse engineering of the Windows Defender emulator, which lives in mpengine.dll. Microsoft combines that local analysis with cloud machine learning models which, according to its documentation, sometimes identify new threats before a single machine is infected.

Metamorphic code makes emulation harder because there is no constant body to expose, and virus authors added anti-emulation tricks such as Simile's RDTSC timing checks or Virut's GetTickCount calls. That is why current defences watch what code does when it runs. Microsoft acknowledges that highly polymorphic threats mutate faster than traditional solutions can keep up with, and bases behavioural blocking on machine learning.

For scripts, AMSI (Antimalware Scan Interface) hands the code to the engines once it reaches the interpreter de-obfuscated, even when it was generated at runtime. PowerShell, Windows Script Host and Office macros integrate the interface. AMSI runs inside the process it inspects and malware can disable it in memory, as MITRE documents for families such as Lumma Stealer, Donut and Brute Ratel C4.

PowerShell script block logging (event 4104) keeps the content of every block processed, including attempts to disable AMSI, and Microsoft recommends protecting it with Protected Event Logging. YARA can scan running processes as well as files, and once a sample reaches the lab, dynamic and in-memory malware analysis recovers the decrypted code.

Which controls and hunts protect an organisation from polymorphic malware?

Microsoft Defender for Endpoint includes attack surface reduction (ASR) rules that act on behaviour and reputation, according to its rules reference updated in September 2026. Together with antivirus and an EDR, these are the layers that deal with changing code.

• The rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" stops one-off or newly created executables (.exe, .dll and .scr), the typical output of per-delivery repacking. It requires cloud-delivered protection and does not cover scripts or shortcuts.
• The rule "Block execution of potentially obfuscated scripts" is documented for PowerShell, and block at first sight sends unknown samples to the cloud and can block them within seconds.
• Application control with App Control for Business in enforced mode blocks wscript.exe and cscript.exe scripts the policy does not allow, puts PowerShell into Constrained Language Mode and blocks mshta.exe. Non-integrated interpreters, including many Python builds, fall outside it, and publisher rules do not stop malware signed with stolen certificates.
• VBScript, the language PROMPTFLUX uses, has been deprecated since October 2023 and ships as a feature on demand, so it can be removed from machines that do not need it.
• EDR detects what repeats across copies because the goal does not change, such as persistence, injection into other processes or outbound traffic, not the exact instruction sequence.

In Defender XDR, advanced hunting turns those ideas into scheduled queries. Thresholds are indicative and should be tuned to each environment.

• Low-prevalence binaries without a valid signature: DeviceProcessEvents | where Timestamp > ago(7d) | summarize Devices = dcount(DeviceId) by SHA1, FileName, FolderPath | invoke FileProfile("SHA1", 1000) | where GlobalPrevalence < 50 or isnull(GlobalPrevalence) | where SignatureState != "SignedValid"
• Script interpreters contacting language model APIs, starting with Gemini's and extending the list with the organisation's AI services: DeviceNetworkEvents | where RemoteUrl has "generativelanguage.googleapis.com" | where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "rundll32.exe")
• Scripts writing to the Startup folder, PROMPTFLUX's persistence: DeviceFileEvents | where FolderPath has @"\Start Menu\Programs\Startup\" | where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "mshta.exe")
• Attempts to disable AMSI in event 4104, looking for strings such as AmsiScanBuffer or amsi.dll in the block text, and threads starting outside loaded modules (Sysmon event 8 with an empty StartModule).

These hunts need rules that are maintained and tested against ATT&CK techniques, the work we describe in detection engineering, and a team reviewing alerts around the clock, such as a managed SOC. Periodic threat hunting covers what rules miss, and systems hardening limits what new code can do once it runs.

Is polymorphic malware still a threat in 2026?

Kaspersky's encyclopedia now describes classic polymorphism as seldom used, because attackers have moved to code encryption and obfuscation. The goal of handing each victim a different sample is still very much alive by other means. As early as 2010, Kaspersky identified server-side polymorphism as the main way malicious files were spread. In that model the mutation engine stays on the attacker's infrastructure and each download receives a different file.

In 2018 CISA described Emotet as a polymorphic banking Trojan able to evade signature-based detection. Webroot put the share of polymorphic malicious executables it encountered in 2017 at more than 94%, and the share of samples seen on a single machine at 93%. These are vendor figures from almost a decade ago, but they show why a hash on its own is a weak indicator.

How is generative AI being used for self-rewriting code?

In January 2023 CyberArk published a research design for polymorphic malware that periodically asked the ChatGPT API for new code modules. In March that year HYAS presented BlackMamba, a proof-of-concept keylogger that synthesised its functionality at runtime.

In November 2025 GTIG reported that, for the first time, it had identified malware families that query large language models during execution. PROMPTFLUX, spotted in June 2025, asked Gemini for VBScript obfuscation techniques to modify itself, and one variant asked for its entire source code to be rewritten every hour. Google placed it in a development or testing phase, with no demonstrated ability to compromise a network, although the code made the aim of building a metamorphic script plain.

In February 2026 the same team described HONESTCUE, which receives C# code from Gemini and compiles it in memory without leaving the payload on disk, probably still at proof-of-concept stage. Its May 2026 report maps PROMPTFLUX to T1027.014 and describes CANFAIL and LONGSTREAM, used by Russia-nexus actors against Ukrainian organisations, which pad their code with decoy logic generated by language models (T1027.016, Junk Code Insertion).

Not all AI-enabled malware mutates either. LAMEHUG, which CERT-UA attributed with moderate confidence to APT28 in July 2025, uses a model hosted on Hugging Face to generate commands, not to rewrite itself. PromptLock, presented in August 2025 as the first AI-powered ransomware, turned out to be an academic prototype from New York University, as we covered in our piece on AI in offensive research.

Malware that queries a model at runtime carries fixed elements with it. According to GTIG, PROMPTFLUX embedded a Gemini API credential in its code, requested the gemini-1.5-flash-latest model, logged its activity to %TEMP%\thinking_robot_log.txt and saved each version to the Startup folder. Those elements support signatures and hunts, and the dependency on the provider allows the service to be cut off, as Google did when it disabled the associated assets.

As of October 2026, ATT&CK has no specific technique for malware that queries a model at runtime. T1682 (Query Public AI Services), added in April, covers the use of AI services for reconnaissance.

When did the first polymorphic virus appear?

According to Kaspersky's encyclopedia, the first polymorphic viruses appeared in 1990 with the Chameleon family (1260, V2P1, V2P2 and V2P6), written by Mark Washburn. In 1992 Dark Avenger distributed the Mutation Engine (MtE), a generator other authors could link into their viruses to make them polymorphic.

Metamorphism spread with 32-bit Windows. Virus Bulletin analysed W95/Zmist, by the Russian author Zombie, in 2001, and in 2002 W32/Simile, whose MetaPHOR engine took up about 90% of the code and whose samples arrived from several large companies in Spain.

Sality, a polymorphic file infector observed since 2003, kept its peer-to-peer network running until 31 August 2026, when CrowdStrike and its partners, including the US Department of Justice and the FBI, disrupted it. The more than 33,000 existing infections remain active and need to be cleaned up.

What do ENS, NIS2 and ISO 27001 require against malicious code?

Spain's National Security Framework (ENS, Royal Decree 311/2022) devotes measure op.exp.6 to protection against malicious code. It requires protection software on workstations, servers and perimeter devices, and scanning of every file from external sources. At HIGH category it adds reinforcement R3, which allows only authorised applications to run, and R4, which calls for EDR tools, according to the official text.

Article 21(2) of the NIS2 Directive does not mention malware explicitly. Commission Implementing Regulation (EU) 2024/2690, which applies to cloud providers, data centres and managed service providers among others, does so in point 6.9. It requires entities to detect or prevent malicious or unauthorised software and, where appropriate, to have detection and response software in place. ENISA's technical guidance of June 2025 also recommends application allowlisting and monitoring of system behaviour.

ISO/IEC 27001:2022 covers protection against malware in Annex A control 8.7, supported by user awareness. The three frameworks point to the two controls that do not depend on recognising what the code looks like, application allowlisting and behavioural detection.

Sources and methodology: this article draws on NIST SP 800-83, MITRE ATT&CK and analyses by Virus Bulletin, Symantec and Kaspersky. It also uses reports from Google Threat Intelligence Group, CyberArk, CERT-UA and CrowdStrike, Microsoft documentation and the texts of the ENS and NIS2, as consulted on 20 October 2026. Vendor figures are dated and illustrative.

Disclaimer: rule, table and product names refer to Microsoft Defender and Windows, and other platforms offer equivalent controls. Queries, ASR rules and application control should be tested in audit mode and adapted to each environment before moving to block mode.