Tox

ToxNetV2 wires an LLM into the decision loop of its botnet controller

Joe Security's teardown of an AArch64 Tox botnet shows a model proposing actions that only an operator command executes, which puts the telemetry worth collecting on the controller rather than on any victim host.