The malware must incorporate an LLM in its functionality to allow it to do something that was infeasible for malware prior to LLMs. For example, running a browser agent on an infected computer to send download links to contacts of the victim, or to log into their bank account, etc.

I'll use my best estimate of the damage done. It must be by a single piece of malware, not multiple. (Though variants are allowed.)