Cyberattackers integrate large language models (LLMs) into the malware, running prompts at runtime to evade detection and augment their code on demand.