ClosedQuorum Malware Lets Four AI Models Vote on Its Next Move

Most malware waits for an attacker’s server to tell it what to do next. A Windows implant that Cisco Talos calls ClosedQuorum asks a panel of commercial AI models instead, then acts on whichever choice gets the most votes.

Talos described the sample on Tuesday and called it, to its knowledge, the first publicly documented Windows implant to hand its command-and-control decisions to large language models. “It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI,” the researchers wrote. The malware is aimed at stealing login credentials and crypto wallets.

The researchers found it with CAIRN, an open-source tool for hunting malware that uses AI services, which Talos released the same day. Talos has no confirmation that ClosedQuorum has been used in a real attack, though artifacts in the binary tied its developer to criminal forum posts about carding going back to 2025, and Talos’s analysis of the code is dated June 17, The Hacker News reported.

How the vote works

The implant, written in Go, queries up to four providers one after another: DeepSeek, Qwen, Mistral and Google Gemini. Each request carries basic facts about the infected machine, such as its name, Windows version and whether the user is an administrator, plus a fixed menu of four actions. Answers that don’t fit the required format are thrown out, and the action with the most votes wins. In a tie, DeepSeek’s pick counts first, followed by Qwen, Mistral and Gemini. If every model fails, the loop sleeps and tries again rather than doing anything by default.

“Steal” dumps the memory of LSASS, the Windows process that holds login credentials, and grabs saved passwords from Chrome, Edge and Firefox along with data from MetaMask, Exodus and Ethereum wallets. “Inject” runs code inside another program using Early Bird APC injection or process hollowing. “Persist” sets up a Registry Run key, a scheduled task and a WMI event subscription, with names styled after Windows Update. “Move” has no code behind it in the analyzed build. Each decision and the model’s stated reason are posted to the attacker’s Discord channel through a webhook, and stolen files follow, encrypted and split into 1,900-byte pieces.

The public build can’t run as shipped. It contains placeholder API keys and a dummy webhook, so Talos didn’t see the full chain work end to end, although development builds show keys being added at build time.

What defenders can look for

Talos advised against simply blocking AI providers’ domains, since plenty of legitimate software calls DeepSeek, Mistral, Gemini, OpenRouter or Discord. What stands out is a Windows program with no reason to use AI sending similar requests to several providers in a short span while also touching LSASS, injecting into suspended processes or creating WMI persistence. Talos published a Snort rule (1:66984), a YARA rule and SHA-256 hashes for six development builds, though the Snort rule will likely need TLS inspection to see the prompts.