Overview
- Cisco Talos researchers analyzed a Go-based Windows implant that queries up to four commercial AI models—DeepSeek, Qwen, Mistral and Google Gemini—to vote on a small set of post-compromise actions.
- The models choose between four coded actions: steal, inject, persist and move, with the steal path dumping LSASS memory and harvesting browser and crypto‑wallet data and the move option lacking an implemented handler in the analyzed build.
- If model votes tie, the implant applies a fixed priority with DeepSeek as the first tiebreaker and posts each model choice and its rationale to an attacker-controlled Discord channel before acting.
- The sample Talos reviewed contained placeholder API keys and a dummy Discord webhook so it could not reach AI services or exfiltrate data without custom built-in credentials, and Talos has not observed confirmed in-the-wild deployments.
- Talos found the tool using its CAIRN hunting toolkit and published detection artifacts and hashes, noting that reliance on commercial AI APIs creates outages, rate-limit and malformed-output failure modes that both constrain attackers and give defenders detection opportunities.