CLOSEDQUORUM: the malware that lets four AI models vote on its next move

On September 22, Cisco Talos disclosed an unusual piece of Windows malware called CLOSEDQUORUM. Rather than take orders from an attacker-run command-and-control (C2) server, it queries commercial AI services — DeepSeek, Qwen, Mistral, and Google Gemini — and asks them what to do next.

One important caveat: Talos has not seen the scheme work from start to finish, and the public version of the malware is non-functional as it stands. The sample surfaced through CAIRN, an open-source tool Talos released the same day to hunt for malware that leans on AI services. Judging by the code's date stamp (June 17, 2026), it is at least three months old. The researchers do not explain how it lands on a victim's machine, but clues in the code tie the developer to criminal-forum posts about carding dating to 2025.

How the vote works

With each request, the malware sends the models basic facts about the machine — name, Windows version, administrator status — and a fixed list of four actions: steal, inject, persist, and move. Every model must reply in a strict format or its answer is discarded. The program tallies the votes and performs whichever action wins the most. If no usable answer comes back, it waits and tries again rather than defaulting to an action. In the public build, "move" has no code behind it.

The attacker still sees every decision along with the model's stated reasoning: before acting, the malware posts them to a Discord channel via a webhook, and stolen data goes to the same place. Each copy needs API keys for the AI services and a real webhook — in the public version both are placeholders.

To Talos's knowledge, this is the first publicly documented Windows implant that hands its C2 decisions to AI models. Earlier malware such as LAMEHUG (reported by Ukraine's CERT-UA in July 2025) asked an AI to write commands for tasks set in its code; here the model chooses the task itself.

What the actions do

When "steal" wins, the program simultaneously dumps LSASS memory, copies saved passwords from Chrome, Edge, and Firefox, and grabs data from the MetaMask, Exodus, and Ethereum wallets. "Inject" runs code inside another program using Early Bird APC injection. "Persist" sets up three autostart mechanisms — a Registry Run key, a scheduled task, and a WMI event subscription that relaunches the malware every 60 seconds; the names are themed on Windows Update.

Talos also flags the weakness of the design: services can refuse requests, throttle them, or return broken output, and the malware depends on companies the attacker does not control. Defenders are advised not to block the AI services' domains but to watch for a telltale combination — traffic to several AI providers interleaved with LSASS access, code injection, and WMI persistence.

Source: The Hacker News