Living Off the LLM: How LLMs Will Change Adversary Tactics
Not on the map. Why?
Abstract (arXiv)
In living off the land attacks, malicious actors use legitimate tools and processes already present on a system to avoid detection. In this paper, we explore how the on-device LLMs of the future will become a security concern as threat actors integrate LLMs into their living off the land attack pipeline and ways the security community may mitigate this threat.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 11 of its 19 references that are in the map. First posted on arXiv 13 Oct 2025.
Builds on
11 of 19 references.
References · 11
- 2024AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attackscited by 96
- 2023From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloadscited by 32
- 2023RatGPT: Turning online LLMs into Proxies for Malware Attackscited by 18
- 2024Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubscited by 18
- 2023LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testingcited by 17
- 2025RapidPen: Fully Automated IP-to-Shell Penetration Testing with LLM-based Agentscited by 11
- 2021Living-Off-The-Land Command Detection Using Active Learningcited by 8
- 2024Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Modelscited by 6
- 2025The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Againcited by 4
- 2024On the Feasibility of Fully AI-automated Vishing Attackscited by 3
- 2025Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detectioncited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.