Project
Open-source framework from Cisco Talos that classifies malware by AI-service metadata traces, assigning identifiers and clustering samples by shared traits.
Gambit Security says an operator chained three open-source AI tools to steal more than 600,000 unexpired card records from two companies. The operator's own review put the average completed scan at $25.46.
Reality
Cisco Talos says the best text that malware authors plant to steer AI analysis tools tipped results their way in about 35% of test runs. The text has to sit in plaintext, so each attempt also gives defenders a string to hunt for.
Reality
Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
Perspective Coverage
7 publishersReality
Gambit Security says one operator used three AI agent tools to steal over 600,000 cards, spending an estimated $12,000 to $18,000. One retailer's scheduled job reinstalled a skimmer after a deploy removed it, so recovery tests have to cover every layer the agents touched.
Reality
Gambit says a single actor pointed the Strix, Cairn and Hermes agent frameworks at online retailers from July onward, taking more than 600,000 valid card records from two victims and leaving skimmers on 119 sites.
Reality
Cisco Talos says its CLOSEDQUORUM sample asks four language models for executable decisions, tallies the votes and acts on the winner. An entire phase of the attack runs while the operator is offline.
Reality
Cisco Talos has published CLOSEDQUORUM, a Windows credential stealer with no command-and-control server. It hands the state of the infected host to Gemini, DeepSeek, Qwen and Mistral, then acts on the majority verdict.
Reality
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
Cisco Talos has open-sourced CAIRN, a framework that tags malware by the traces its AI calls leave in metadata. The first sample it surfaced polls DeepSeek, Qwen, Mistral and Gemini for orders and decides for itself.
Reality