CLOSEDQUORUM malware lets four AI models choose its next move

A Windows malware called CLOSEDQUORUM is built to let up to four commercial AI models choose its next action instead of receiving orders from a command-and-control server, according to a report from Cisco Talos published on September 22. Command-and-control, often called C2, is the attacker's remote channel for sending instructions to infected computers. Talos said this is the first publicly documented Windows implant that hands its C2 decisions to AI models. The malware asks DeepSeek, Qwen, Mistral, and Google Gemini what to do, and the models choose among a fixed list of actions. The public version of the malware does not work as it is because it has placeholder values for API keys and a Discord webhook, but Talos has analyzed development builds. The code is at least three months old, since Talos's analysis is dated June 17, 2026.

In a typical malware operation, the attacker's server tells the implant what to do next. CLOSEDQUORUM works differently. With each request, the malware sends basic facts about the computer, such as its name, Windows version, and whether it has administrator rights. It also sends a fixed list of actions for the models to choose from: steal, inject, persist, and move. In the public version, the move action has no code behind it, so selecting it does nothing. Each model must answer in a set format; if an answer does not follow that format, it is discarded. The malware counts the valid answers and carries out the action with the most votes. If no model gives a usable answer, the malware waits and tries again rather than choosing a default action. Because the models make each choice, the attacker does not have to send commands once the malware is running. The attacker still observes each decision and the model's stated reason, because before acting the malware posts them to a Discord channel through a Discord webhook. A webhook is a special URL that lets a program send messages to a channel. Stolen data is sent to the same channel. To work, each copy needs API keys that allow the program to use the AI services, and a real Discord webhook. Test versions show that the keys are added when the program is built. The public version has placeholder values for both, so it cannot reach the models or send data.

When the vote selects steal, the malware does three things at once, Talos found. It dumps the memory of LSASS, a Windows process that holds login credentials. It also copies saved passwords from Chrome, Edge, and Firefox, and it steals data from MetaMask, Exodus, and Ethereum crypto wallets. If the inject choice wins, the malware runs code inside another program. It uses a technique called Early Bird APC injection, or process hollowing if the model asks for it. Both methods hide malicious code inside a normal-looking process. If persist wins, the malware sets up three ways to start again automatically. It creates a value under the current user's Registry Run key named WindowsUpdate, creates a scheduled task, and creates a WMI event subscription that starts the malware every 60 seconds. The Registry value and WMI names are themed on Windows Update so they look like normal system activity. Before sending stolen files, the malware copies them into C:\Windows\Temp\, encrypts them, and splits them into 1,900-byte pieces. It then posts one piece per second to the attacker's Discord channel.

Talos advised defenders to watch for behavior rather than simply block the domains of the AI services, because legitimate programs may contact DeepSeek, Mistral, Gemini, Discord, or OpenRouter. Far fewer programs would contact several of these services while also accessing LSASS, injecting code into suspended processes, or creating WMI persistence. No single sign identifies the malware, but the combination stands out. Signs include AI-service traffic from a Windows program that is not expected to use AI, similar requests sent to several AI providers within a short time, prompts that contain details about the computer or attack language, process injection, LSASS access or new persistence, Discord webhook traffic from the same program or computer, and activity that repeats at random intervals of five to fifteen minutes. Prompts are likely visible only with TLS inspection, which decrypts HTTPS traffic, or to the AI provider. Talos published a Snort rule, 1:66984, that looks for the malware's prompts to the AI services, and because prompts are likely visible only with TLS inspection, the rule would likely need TLS inspection to match them. Talos also published a YARA rule written mainly to search VirusTotal's data about files. Parts of that rule, such as the text the malware sends to the AI models, match only when the file itself is scanned. The rule file that comes with CAIRN did not include a CLOSEDQUORUM rule when The Hacker News checked it on September 23, so CAIRN users would need to add Talos's rule themselves.

Talos published SHA-256 hashes for six development builds. They are 250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7, c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7, c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f, f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c, 5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb, and eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5. Other traces the malware would leave include a Registry value named WindowsUpdate under the current user's Run key, a PowerShell script at a path consistent with C:\Windows\Temp\wmi.ps1, and a WMI permanent event subscription with Windows Update-themed names that starts the malware every 60 seconds.

Talos found the malware with CAIRN, an open-source tool it released the same day to hunt for malware that uses AI services. The researchers did not describe how the malware would get onto a victim's computer, but they said clues in the code tied the developer to criminal forum posts from 2025 about carding, which is the trade in stolen card data. AI has been used in malware before. LAMEHUG, which Ukraine's CERT-UA reported in July 2025, asked an AI model to write commands for tasks set in its code. CLOSEDQUORUM is different because it asks the models to choose the task. Talos calls CLOSEDQUORUM an early and limited example of attackers handing part of an attack to AI models. Relying on external AI services creates weak points for the attacker. The services can refuse requests, limit how many they answer, or return broken output. The malware also depends on companies it does not control.

For website owners and administrators, the most important lesson is that this malware is built to collect saved browser passwords, including those for hosting control panels, WordPress admin accounts, and email. A stolen credential can be the fastest route into a live website. Keeping those credentials out of the browser and enabling two-factor authentication limits the damage if a local machine is infected. AEU Hosting, which provides managed WordPress hosting with server-side security controls, is one way to reduce the blast radius of a credential-stealing attack on the desktop, because key site protections are handled at the host rather than only on the administrator's own computer.