AI is changing how malware works

Attackers are building AI into their hacking tools, prompting Cisco Talos to create a new framework called CAIRN to track and analyze these evolving threats.

Meet CAIRN, the malware detection system

The open-source framework identifies AI fingerprints left behind in malware code, allowing researchers to classify and track AI-integrated hacking tools.

“The core idea is that AI integration has these vestiges, like fingerprints, that are left behind.”

Closedquorum runs on AI consensus

Researchers found a Windows malware that polls four different AI models (DeepSeek, Qwen, Mistral, and Google Gemini) to decide what to do next, with no human involvement needed.

The discovery came from a phishing campaign

In July 2025, Ukrainian cybersecurity officials detected malware called LAMEHUG using an AI model to receive commands, sparking researcher Ryan Fetterman's investigation into AI-integrated threats.

The threat is bigger than expected

Fetterman initially found only nine documented examples of AI-integrated malware, but using CAIRN he discovered about 20 additional cases, suggesting the landscape is far more complex than publicly known.

“There's a lot going on out there, and it does provide a valuable early signal to what's going to happen.”

Attackers are operationalizing AI

Rather than just using AI for productivity, attackers now deploy it to run more campaigns simultaneously, hit more targets, and handle multiple systems with minimal human oversight.

“Now what we're seeing is that it's becoming operationalized.”

Closedquorum targets financial data

The malware is designed to steal login credentials and cryptocurrency, with links to cybercriminal forums discussing credit card fraud dating back to 2025, though actual real-world attacks remain unconfirmed.