User uses local Qwen3.8-27B to offline reverse-engineer malware that hijacked his Discord

Toooooool · reddit · 2026-09-06

A Reddit user recounts how a local LLM became his incident-response tool after a malware infection:

The hack: A friend-shared "watch together" site pushed a fake 150MB installer; his Chrome and Discord crashed, and a hacker took over his Discord, wiped his friend list, demanded $200 in gift cards, and got the account permabanned by posting blackmail content.
Standard tools failed: Windows Defender full scan found nothing; AdwCleaner removed a suspicious AVG Toolbar that reappeared minutes later, confirming the malware was still resident.
The local LLM playbook: Offline, he fed the malware file (actually a 7zip archive) into a project folder and prompted local Qwen3.8-27B to analyze it with explicit instructions not to execute it. In about 60 minutes the model fully unwrapped the sample's multi-layer obfuscation and deciphered its structure.

A striking demo of local LLMs doing offline malware triage — analyze the sample, never run it.

More from Fun