Cisco Talos's new malware tagger roughly tripled the public tally of AI-integrated samples

Ryan Fetterman doubted his own list. "There really wasn't a lot there. I think I came up with maybe nine different named malware families," the Cisco Talos researcher told Wired about the retrospective he ran this summer ^[10], and some of those were proofs of concept built for research ^[11]. He said he was shocked he could only find a few documented examples, and had a hard time believing that was the reality ^[19].

CAIRN works on metadata. It flags the attributes an AI integration leaves behind, tags the sample with what amounts to a unique ID, then analyzes it against everything else in the library and groups samples by shared traits ^[3]. Fetterman said the traces are the signal: "The core idea is that AI integration has these vestiges, like fingerprints, that are left behind" ^[9]. Practitioners have used digital fingerprints for years to identify hacking tools and track their use over time ^[17].

Add the roughly 20 examples Fetterman found using CAIRN to the nine he had documented and the known population is about 29, some 3.2 times the publicly reported count ^[13][14]. He said the tooling is "still largely experimental for attackers" but that "the landscape is a lot more complex and diverse than has been publicly reported" ^[15].

The two named samples in the record sort into different boxes. In July 2025, Ukraine's CERT-UA warned about a phishing campaign using an implant called LAMEHUG, which fetched its commands from a single model, Qwen2.5-Coder-32B-Instruct, through a Hugging Face API ^[12]. CLOSEDQUORUM checks with DeepSeek, Qwen, Mistral and Google Gemini for a consensus on its next step ^[5], and if one service is unavailable it polls the others; an operator has no way into that loop ^[6]. Two questions separate them: how many providers the sample depends on, and whether any route exists for an operator to intervene. The one-provider, human-in-the-loop box gives a defender an abuse report to file and an endpoint to block.

Matt Olney, senior director of threat intelligence at Talos, put the change in terms of throughput. "Now what we're seeing is that it's becoming operationalized. So for attackers, it's allowing them to run more campaigns, hit more spaces, handle more and different computers, because they have this very intelligent box in the backend that can ask questions and give responses," he said ^[16]. Talos saw links between CLOSEDQUORUM and cybercriminal forums about credit card fraud going back to 2025, and the malware is built to steal login credentials and cryptocurrency ^[7]. The researchers could not confirm who developed it or whether it has been used in a real attack ^[8].

For a team triaging samples next week, the cheap version of this is a field on the sample record: which model or API the sample calls, over what transport, and what it does when that call fails. Backfilling it across what you already hold costs an analyst a week, produces a count and a baseline, and prevents no infections. The case for doing it before writing heuristics is that nine became about twenty-nine on classification alone, so a rule tuned against the nine was covering roughly 31 percent of the known problem ^[18].