Tech Times

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Autonomous AI malware CLOSEDQUORUM lets DeepSeek, Qwen, Mistral, and Gemini vote on attack decisions with no human operator, Cisco Talos disclosed September 22. The four-model plurality structure ...

Researchers found malware that uses four different AI chatbots to run itself, no human hacker needed

The malware, called CLOSEDQUORUM, checks with DeepSeek, Qwen, Mistral and Google Gemini before selecting its next action. It can continue operating if one of those services ...
CSO Online

AI malware just removed the human from the attack loop

CLOSEDQUORUM queries multiple models, tallies their decisions and automatically executes the winning action, eliminating the ...
Help Net Security

Researchers uncover malware that uses AI to choose its next move

CAIRN, Cisco Talos' open source framework, is designed to help security practitioners hunt down malware that uses AI.
WeLiveSecurity

GuardBreaker: Derailing AI-assisted malware analysis with a code comment

Malware developers have long adapted their code and tactics to the defenses and scrutiny that are likely to stand in their way. Using various evasion and anti-analysis methods, they routinely attempt ...
scworld

F5 BIG-IP malware hides web shells in memory to evade detection

Stealthy malware tied to break-ins on F5 BIG-IP Access Policy Manager (APM) appliances let attackers hide PHP web shells in memory as opposed to a file on disk. In a Sept. 7 blog post, Sophos said ...
securityaffairs

PoisonedRefresh: A Fileless Linux Rootkit That Injects PHP Web Shells Into F5 BIG-IP APM Server Memory

PoisonedRefresh rootkit injects PHP web shells into F5 BIG-IP APM Apache memory, leaving no disk artifacts. SophosLabs published a detailed technical analysis on September 8, 2026, of a Linux implant, ...
The Hacker News

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans

Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache ...
The Hacker News

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are ...
Hacker

Prominent Cyber Attacks of 2026 and What They Teach Us About Emerging Attack Trends

In early 2026, the global threat landscape underwent a structural transformation. Cybercriminals abandoned traditional, high-friction attack vectors in favor of targeting the core pillars of modern ...
Hosted on MSN

The methods intruders use to reach your accounts without any malware

The methods intruders use to reach your accounts without any malware Who are these outfits even for? 💀 The 'Cornell 7' haven't been charged. The mob doesn't care | Opinion Stella Lefty reacts to ...