Cisco Talos Details CLOSEDQUORUM AI-Guided Windows Malware

Cisco Talos has documented CLOSEDQUORUM, a Windows malware prototype designed to ask up to four commercial AI models to vote on its next action rather than receive instructions from an attacker-operated command-and-control server. The models named in the analysis are DeepSeek, Qwen, Mistral and Google Gemini. Talos said it has not observed the arrangement functioning end to end, and the publicly available sample does not work as supplied.

Talos identified the malware with CAIRN, its open-source hunting tool for malware that uses AI services. Code analysis is dated June 17, 2026, indicating that CLOSEDQUORUM is at least three months old. Clues in the code also link its developer to criminal-forum posts about carding dating to 2025, although Talos did not describe how the malware would initially reach a victim machine.

Voting replaces conventional tasking

Conventional malware commonly receives commands from a C2 server controlled by an attacker. CLOSEDQUORUM instead transmits basic host information, including the computer name, Windows version and administrator status, alongside a fixed action list. The available options are steal, inject, persist and move.

Each AI service must return an answer in a prescribed format. The malware discards answers that do not comply, counts the usable responses and executes the option with the most votes. If no model produces a usable response, the implant waits and tries again rather than selecting a default action. In the public build, the move option has no associated code, so selecting it has no effect.

Before acting, the malware sends the vote and each model's stated rationale to an attacker Discord channel through a webhook. A functioning build would require API keys for the AI services and a genuine Discord webhook; test versions suggest these values are embedded during compilation. The public sample contains placeholder values for both, preventing it from contacting the models or transmitting data.

Credential theft, injection and persistence

When the winning action is steal, Talos found that CLOSEDQUORUM can dump LSASS memory, copy saved passwords from Chrome, Edge and Firefox, and collect data from MetaMask, Exodus and Ethereum wallets. It stages files in C:\Windows\Temp\, encrypts them, splits them into 1,900-byte chunks and posts one chunk per second to Discord.

The inject option can use Early Bird APC injection, or process hollowing when requested by a model, to run code within another program. The persist option establishes three restart mechanisms: a value under the current user's Registry Run key, a scheduled task and a permanent WMI event subscription launched every 60 seconds. The Registry and WMI names use Windows Update-themed wording to resemble routine system activity.

Detection should focus on combined behaviour

Talos described CLOSEDQUORUM as an early and limited example of attackers delegating part of an intrusion to AI models. This approach has weaknesses: AI providers can refuse prompts, rate-limit requests or return unusable output, and the implant depends on services outside the operator's control. Talos distinguishes it from LAMEHUG, reported by CERT-UA in July 2025, which used an AI model to generate commands for tasks already specified in code; CLOSEDQUORUM asks models to choose the task itself.

Blocking AI-service domains alone is unlikely to be a reliable control because legitimate software can contact DeepSeek, Mistral, Gemini, Discord or OpenRouter. Talos advises defenders to look for their combination with AI traffic from unexpected Windows programs, similar near-simultaneous requests to several providers, LSASS access, injection into suspended processes, new persistence and Discord webhook traffic. It also notes activity recurring at random intervals of five to 15 minutes.

Talos published Snort rule 1:66984 for the malware's AI prompts, although matching those prompts will likely require TLS inspection. Its YARA rule is chiefly intended for VirusTotal file data, and CAIRN users would need to add Talos's CLOSEDQUORUM rule themselves. For businesses, the practical implication is to baseline legitimate AI-service use on Windows endpoints and escalate it when it coincides with credential access, process injection, Windows Update-themed persistence or Discord-based data transfer.