Scammers hide callback numbers in real Dell and Staples order emails
Cisco Talos saw about 1,400 messages whose DKIM and DMARC checks still passed.
1
Stories per day · 30 days
7 RSS
Relatedadversary-in-the-middle1callback-phishing1cve1dell1dmarc1google1ivanti1kev1mfa1patch-debt1quishing1sonicwall1spear-phishing1staples1taiwan1uat-119851uat-62751vulnerability-management1
44 stories, newest first · one card per story
Stories tagged #cisco-talos
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Cisco Talos says UAT-11985 uses fake event invites and Google AitM phishing against Taiwan research affiliates.
9
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
UAT-11985 used likely AI-written event invites and an AiTM kit to steal Google sessions from Taiwan researchers.
5
Cisco Talos Warns Autonomous AI Agents Could Turn Pentests Into Stealthy Red Team Attacks
Cisco Talos warns autonomous AI agents may shift from noisy scans to stealthy, persistent intrusions.
7
Cisco Talos Warns AI Agent Swarms Can Compress Cyberattacks From Months to Hours
Cisco Talos warns AI agent swarms can compress sophisticated cyberattacks from months of work into hours.
5
Making sure the checks get printed
Cisco Talos CAIRN research reveals malware authors embedding natural-language prompt-injection instructions in binaries to evade AI-assisted analysis, succeeding ~35% of the time.
3
One breach, please, and make no mistakes
Cisco Talos says AI agent swarms already attack infrastructure and defenders must rehearse quieter campaigns.
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
China-linked UAT-11587 used the Antino backdoor and Microsoft 365 to spy on Asian governments.
Researchers find Chinese hacking campaigns targeting AI firms, Asian governments
Chinese state-backed groups phished AI researchers and used the Antino backdoor against Asian governments, hitting about 350 endpoints.
Give yourself room to be human
Cisco Talos Threat Source newsletter shares Cybersecurity Awareness Month defender strategies and weekly headlines; bulk is personal editorial on workplace well-being.
1
The Fine Art of Frustrating the Adversary
Cisco Talos researchers share defender techniques—deception, honeypots, behavioral detections, and AI agent boundaries—to slow and expose adversaries.
4
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Cisco Talos attributes China-nexus UAT-11587 to espionage against Asian governments using the Rust-based Antino backdoor, with ~350 compromised endpoints in eight countries.
2
Securing the keys to the kingdom: Announcing Executive Threat Detection
Cisco Talos launched Executive Threat Detection, monthly human-led hunts for stealthy attacks on executives.
1
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.
2
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.
5
Cisco Talos Launches CAIRN Tool to Hunt and Track AI-Integrated Malware
Cisco Talos released CAIRN, an open-source toolkit to identify AI-integrated malware by analyzing metadata for 'cognitive artifacts' from LLMs.
4
This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next
Cisco Talos documents CLOSEDQUORUM, a Windows implant that votes across DeepSeek, Qwen, Mistral, and Gemini APIs to choose attack actions autonomously.
1
Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control
Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.
2
AI malware just removed the human from the attack loop
Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.
1
Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.
2
New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
2
A New Tool for Tracking AI Malware Uncovers Malware That Operates Without Human Control
Cisco Talos releases CAIRN to track AI malware and documents CLOSEDQUORUM, an unconfirmed Windows implant steered by LLMs.
1