other

LAMEHUG

Malware implant used in phishing activity against Ukrainian targets that retrieves its commands from a hosted large language model over a public inference API.

Current clusters

build1 publisher

A tie in CLOSEDQUORUM's four-model vote hands the decision to DeepSeek

Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.

Publishers:runtimewire.com

Reality

Evidence58
Adoption18
Hype gap+10
Incentives60
Confidence55

product1 publisher

Cisco Talos's new malware tagger roughly tripled the public tally of AI-integrated samples

Cisco Talos has open-sourced CAIRN, a framework that tags malware by the traces its AI calls leave in metadata. The first sample it surfaced polls DeepSeek, Qwen, Mistral and Gemini for orders and decides for itself.

Publishers:wired.com

Reality

Evidence55
Adoption18
Hype gap+26
Incentives62
Confidence58