LSASS (Product): news timeline & CVEs

Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection

A local uncensored Qwen model revised an LSASS dumper until two lab EDRs no longer detected it.

Project Black researcher Eddie Zhang reported that a locally hosted, uncensored Qwen 3.8 27B model revised a Windows LSASS credential dumper until two unnamed lab EDR products generated no detections. Hosted Claude models refused the task, while DeepSeek v4 Flash 0731 produced an initial dump that still alerted and then applied a safety guardrail. The result is limited: EDR vendors and configurations were not published, and lab success does not prove a universal bypass. Microsoft’s cited defenses include LSASS Attack Surface Reduction, Protected Process Light, and Credential Guard.

Cyber Security NewsSep 26, 16:40 UTC · 16h agoAI safety & security 2 sources

Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control

Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.

Cisco Talos researchers identified CLOSEDQUORUM, a Windows malware implant that uses commercial large language models as an autonomous command-and-control layer. The malware gathers host context, queries a panel of LLM providers (DeepSeek, Qwen, Mistral, Gemini), and executes prebuilt malicious capabilities like credential theft and process injection based on model votes. While not yet observed in active attacks, the sample is linked to criminal-forum activity from 2025, demonstrating a shift from human-driven to AI-driven attack phases.

GBHackersupdated Sep 24, 05:44 UTC · 3d agofirst Sep 23, 05:52 UTC · 4d agoMalware 13 sources

LSASS

Timeline2 articles

Appears with

Local AI Model Modifies Windows Credential Dumper to Bypass EDR Detection

Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control