Topic
Malware that embeds a language model into its own operation rather than merely being written with model help.
Acronis says a new backdoor pair is hitting Afghan telecom and South Asian critical infrastructure, with one implant running command and control through the Google Sheets API.
Reality
Zimperium says RatHat uses an accessibility grant to switch on Wireless Debugging and read its own 6-digit pairing code, leaving native daemons at shell privilege that keep answering after the app is removed.
Perspective Coverage
6 publishersReality
Chainalysis says writes of malware instructions to public blockchains have climbed from about 2.06 a day to 11.1 since July 2025, with groups tied to North Korea and Iran behind most of the increase. Its research lead could not confirm AI models helped.
Reality
A publication ban lifted this week on the case Profero opened in April, when its responders pulled a 101MB RAT that had reportedly reached dozens of Israeli companies through a security vendor's own endpoint component.
Reality
Joe Security's teardown of an AArch64 Tox botnet shows a model proposing actions that only an operator command executes, which puts the telemetry worth collecting on the controller rather than on any victim host.
Reality