Image: securityaffairs.com · rights & removal

CLOSEDQUORUM, the malware that asks four AI models what to do next

Reporting by Security Affairs (Pierluigi Paganini)Read the original at securityaffairs.com

Executive Summary

Malware named CLOSEDQUORUM delegates tactical decisions to a panel of four commercial Large Language Models—DeepSeek, Qwen, Mistral, and Google Gemini—to select its next action without human intervention. The malware queries these models based on gathered host information, requiring each model to choose from the options: steal, inject, persist, or move. If the models disagree, a predetermined tie-breaking order is used: DeepSeek, Qwen, Mistral, and then Gemini. The chosen action dictates specific malicious functions; for example, 'steal' initiates credential dumping and crypto wallet scanning, while 'inject' involves writing shellcode. The malware avoids traditional Command and Control (C2) by encrypting stolen data and transmitting it via a Discord webhook instead of a dedicated server. Security analysts identify this activity through correlated signals like repeated execution intervals, specific AI API traffic from unexpected executables, and communication with Discord. The encryption key is derived from the current date, which allows for potential decryption by the operator.

Facts Only

* Malware name: CLOSEDQUORUM.
* The malware delegates tactical decisions to four commercial LLMs: DeepSeek, Qwen, Mistral, and Google Gemini.
* The decision process involves asking these models what to do next and executing the choice with the highest vote count.
* The malware gathers host information such as hostname, OS version, admin status, and performs credential dumping from LSASS memory and scans for crypto wallets (MetaMask, Exodus).
* Actions include stealing credentials, injecting shellcode, persisting, or moving.
* In case of a tie, the tie is broken by a fixed order: DeepSeek, Qwen, Mistral, Gemini.
* Stolen material is encrypted with an AES-256-GCM key derived from the current date and sent via a Discord webhook.
* Observable signals include repeated execution at 5–15 minute intervals, AI provider API traffic from unexpected executables, similar requests to several models, presence of known malware techniques for LSASS access or process injection, and Discord webhook communication.
* Development builds reportedly contain real credentials baked in at compile time.
* Artifacts link the malware's developer to carding forum posts dating back to 2025.

Full Take

The core tension in this threat lies in the shift from human-controlled automation to autonomous, distributed decision-making within an attack chain, a concept termed effort displacement. This moves beyond mere speed and scale of execution; it removes the human operator from an entire phase of the intrusion by delegating tactical choice to an AI quorum. The pattern of using commercial, public APIs for multi-agent coordination introduces a systemic risk where security visibility is circumvented not by hiding traffic, but by mimicking legitimate, complex interactions with known services like LLM endpoints and chat platforms. The method of data exfiltration via Discord webhooks, masked as benign application traffic, exemplifies how modern defensive measures focused on network boundaries struggle against behavior-based analysis. Furthermore, the weak encryption scheme based on the date reveals a failure in operational security that betrays the development process itself. This points to a deeper implication: if AI can execute phases of an attack autonomously and remain operational while human oversight is absent, the focus for defense must shift from detecting individual malicious actions to monitoring complex, correlated behavioral signatures across multiple external dependencies.
BRIDGE QUESTIONS:
What are the systemic implications of allowing autonomous decision-making in malware C2 chains, and how should security architectures be re-envisioned to account for multi-agent operational logic?
If operators cannot rely on traditional indicators, what new metrics or frameworks are necessary to measure the risk introduced by effort displacement across advanced AI systems?
How can defenders effectively monitor emergent behavioral patterns that correlate seemingly disparate activities—such as API calls, process activity, and communication channels—to identify these novel autonomous threats?

From the original · Security Affairs (Pierluigi Paganini)

Cisco Talos found malware, dubbed CLOSEDQUORUM, that holds a vote before deciding what to steal from you. Four AI models vote on its next move, without any human interaction.

Read the full story at securityaffairs.com

Sentinel — Human

Confidence

The text reads like a detailed forensic report synthesized by an expert, balancing highly specific technical details with broader conceptual analysis about the implications of AI in cyber operations.

Signals Detected

Moderate sentence length variance; use of specific technical terminology mixed with narrative framing.

Strong focus on developing a complex, novel concept ('effort displacement') supported by detailed case study structure.

Logical flow from technical description to high-level implication (speed/scale) and back to specific artifacts, suggesting an authorial thesis.

Specific, verifiable details (model names, malware functions, tie-breaking rules, encryption detail) suggest grounded reporting rather than pure fabrication.

Human Indicators

The nuanced discussion around 'effort displacement' and the subtle critique of current threat modeling suggests a human analyst synthesizing technical findings into strategic implications.

The presence of specific, context-rich observations (e.g., why the weak encryption choice matters) implies an understanding beyond simple data recitation.