{"data":{"id":"20c00376-4203-47b6-b336-1fe1a49ea148","title":"AI malware just removed the human from the attack loop","summary":"Cisco Talos researchers describe CLOSEDQUORUM, a malware binary they call the first \"LLM-as-C2\" architecture, which uses a panel of large language model judges to automate command-and-control and steal credentials. It targets LSASS credential dumping and browser saved passwords in Chrome, Edge and Firefox, plus crypto wallets such as MetaMask, Ethereum and Exodus. Cisco Talos states there is not yet any confirmation of its deployment in the wild.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://www.csoonline.com/article/4225264/ai-malware-just-removed-the-human-from-the-attack-loop.html","publishedAt":"2026-09-23T00:39:51.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google","Microsoft","Mistral"],"affectedVendorsRaw":["DeepSeek","Qwen","Mistral","Google Gemini"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-23T00:39:51.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}