Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis

This report presents a serial multi-agent LLM pipeline for macOS malware reverse engineering that treats each tool (r2, Ghidra, Binary Ninja, IDA Pro) as an independent skeptical analyst; using deterministic bridge scripts and an in-memory Shared Context, the system cross-validates findings, enforces an Active Rejection Mandate to filter decompiler artifacts, and produces address-anchored reports — illustrated with samples and hashes for WizardUpdate, a Go infostealer, FinderRAT, and SysJoker.