Cisco Talos built an open-source framework called CAIRN. It flags AI-integration traits in malware to classify and track samples. CAIRN already found a Windows hacking tool named CLOSEDQUORUM. CLOSEDQUORUM polls DeepSeek, Qwen, Mistral and Google Gemini for directives. The tool has no human input mechanism. It steals login credentials and cryptocurrency. Researchers linked it to cybercriminal forums from 2025. They could not confirm its real-world use. CAIRN also uncovered about 20 other AI-integrated malware examples. Researchers say AI is becoming operationalized for attackers.
What changed
AI-integrated malware was tracked by digital fingerprints alone.
What it unlocks
Classifying and analyzing AI-integrated malware using unique AI-generated artifacts.
- 20 AI-integrated malware families found
- 4 LLMs polled by CLOSEDQUORUM
- 9 named malware families initially documented
Sources