Cisco talos unveils tool to track ai-powered malware with no human involvement

Cisco Talos researchers have introduced CAIRN, an open-source framework designed to detect and analyze malware that uses AI without human intervention. The tool identified a new malware family called CLOSEDQUORUM, which operates through a hive mind of four large language models. Ryan Fetterman, a security researcher at Cisco Talos, explained that AI integration leaves traces, like digital fingerprints, which can be used to track and classify malware. In July 2025, CERT-UA warned about a phishing campaign using LAMEHUG, which communicated with an LLM via Hugging Face API. Fetterman was surprised to find only a few documented examples of AI-integrated malware a year later, prompting the development of CAIRN. The tool has since identified 20 additional examples, highlighting the growing complexity of AI-enabled threats. CLOSEDQUORUM, a Windows malware, polls DeepSeek, Qwen, Mistral, and Google Gemini to determine its actions, operating independently without human input. Cisco Talos linked the malware to cybercriminal forums discussing credit card fraud dating back to 2025. Matt Olney, senior director of threat intelligence at Cisco Talos, noted that AI is becoming operationalized for malicious use, enabling attackers to conduct more sophisticated campaigns. The researchers could not confirm the malware's developers or its use in real-world attacks, but they emphasized its potential impact on the cybersecurity landscape.