A newly identified Windows malware named CLOSEDQUORUM has been engineered to execute its operations through a consensus of up to four AI models, diverging from the traditional method of receiving commands from an attacker’s server, according to Cisco Talos. This innovative approach was reported on September 22, highlighting a shift in how malware might operate in the future.
Though the malware is capable of extracting Windows credentials, browser passwords, and cryptocurrency wallet data, it has not yet been observed executing these functions from start to finish. Its public version is currently non-functional, as confirmed by Talos’s analysis, which dates back to June 17, 2026. The discovery came alongside the release of CAIRN, an open-source tool designed to detect AI-utilizing malware.
AI Models Taking Control
Instead of relying on a command-and-control (C2) server, CLOSEDQUORUM queries up to four AI services—DeepSeek, Qwen, Mistral, and Google Gemini—to determine its next steps. The malware transmits basic system information, including the computer’s name, Windows version, and administrator status, alongside a list of predefined actions for the AI models to select.
The models choose among actions such as steal, inject, persist, and move, although the ‘move’ option currently lacks functionality. Each AI model must respond in a specific format, and the malware proceeds with the action that receives the majority vote. If no valid responses are received, the malware waits and retries, avoiding default actions.
Operational Mechanics and Limitations
While the malware operates autonomously via AI decisions, the attacker remains informed of each step through a Discord channel. Before executing any action, CLOSEDQUORUM posts its decisions and the corresponding AI rationale to the channel using a Discord webhook. This is also where the stolen data is sent.
Functionality depends on API keys and an active Discord webhook, which are incorporated during the malware’s compilation. Test versions showed placeholders for these credentials, rendering the public version unable to access AI services or transmit data effectively.
Defensive Measures and Detection
Talos advises security professionals to focus on behavioral analysis rather than blocking specific AI domains, as legitimate applications may also communicate with these services. Indicators of compromise include unusual AI service traffic, multiple AI provider requests, LSASS access, and process injections.
The malware uses specific techniques like Early Bird APC injection and process hollowing for code execution, while persistence is achieved through Windows Registry modifications and WMI event subscriptions. Encrypted stolen files are fragmented and uploaded to Discord in small increments.
Talos has issued a Snort rule, 1:66984, to detect prompts sent to AI services, though it requires TLS inspection for effectiveness. YARA rules are also available, primarily for scanning file data.
In summary, CLOSEDQUORUM represents a novel use of AI in malware, underscoring potential vulnerabilities and challenges in cybersecurity. Vigilance and adaptation in defense strategies are crucial as these threats evolve.
