Cisco Talos found malware, dubbed CLOSEDQUORUM, that holds a vote before deciding what to steal from you. Four AI models vote on its next move, without any human interaction.
CLOSEDQUORUM is the first Windows malware they’ve seen that hands its tactical decisions to a panel of commercial AI models instead of a human operator. Once it lands on a machine, it doesn’t wait for instructions. It asks four different large language models what to do next, tallies their answers, and acts on whichever choice gets the most votes.
“CLOSEDQUORUM is, to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2). After deployment, it delegates the selection of its next action to a panel of commercial large language models (LLMs) and executes the resulting decision, with the intent of harvesting user credentials and crypto wallets.” reads the report published by Talos. “It does not require continued commands from a human operator or tasking from a dedicated, attacker-operated C2 server; the complete dynamic operation is delegated to the AI.”
The name makes sense. A quorum needs a minimum number of people to make a decision, and this one has exactly four members: DeepSeek, Qwen, Mistral, and Google Gemini. There is no human involved. Talos discovered the malware using CAIRN, a new open-source toolkit designed to find threats that use AI. This is the first case study from the project.
Most discussions about AI and cybercrime have focused on speed and scale. Attackers can write phishing emails faster, create more malware variants, and carry out more attacks with less effort. That’s true, but in these cases, a human is still in control, choosing the targets and deciding when to attack.
Talos calls what CLOSEDQUORUM does something different: effort displacement. It’s not making an operator faster at their job. It’s removing them from an entire phase of the job.
“A third dimension has received less attention in the malware space: effort displacement. This is not merely augmenting what an operator can accomplish in a session but transferring an entire phase of the attack from the operator to the system. Effort displacement compounds the effects of speed and scale because the human-in-the-loop is no longer the bottleneck.” Talos continues. “Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps.”
On execution, the malware gathers basic host information, hostname, OS version, admin status, and folds it into a prompt sent to each of the four models in turn. Each model has to answer with one of exactly four options: steal, inject, persist, or move. Anything that doesn’t match the format gets thrown out.
Steal runs three things at once: dumping credentials from LSASS memory, pulling saved passwords out of Chrome, Edge, and Firefox, and scanning for crypto wallets like MetaMask and Exodus. Inject writes shellcode and picks a delivery method depending on what the model recommends. Persist sets up the usual mechanisms to survive a reboot. Move is defined in the code but has no actual function behind it yet, so calling it does nothing.
If the four models disagree and end up tied, there is a fixed order for breaking the tie: DeepSeek first, followed by Qwen, Mistral, and Gemini. It’s not a sophisticated system. The model that loads first in the code simply gets the final say.
The malware encrypts everything it steals and sends it out through a Discord webhook instead of a traditional command-and-control server. That’s the interesting part. Security teams can block domains, IP addresses, or certificates, but a Windows process quietly connecting to four AI APIs and a chat service can look like normal application traffic, at least until its other activity raises a red flag.
“Stolen material arrives AES-256-GCM encrypted in the operator’s Discord channel as base64 code blocks.” continues the report. “CLOSEDQUORUM replaces a dedicated C2 endpoint with a chain of correlated behaviors. No single indicator fully identifies the architecture, but the combination is distinct: Repeated execution at randomized 5 – 15-minute intervals; AI-provider API traffic originating from an unexpected Windows executable; Similar requests potentially sent to several model providers within a short interval; Structured prompts containing host context or offensive capability language (Note: This would likely only visible through TLS inspection or provider-side telemetry); Numerous known malware techniques for process injection, LSASS access, or persistence creation; Discord webhook communication from the same process or host.”
The encryption is worth a second look too, mostly because it’s weaker than it sounds. The key comes from the current date, not a proper secret, which means the malware’s own developer could decrypt any operator’s stolen data just by knowing what day it is. That’s obfuscation dressed up as security, and it’s a detail that says something about how this whole operation was actually built.
The public sample Talos pulled apart is inert. It ships with placeholder API keys and a dummy webhook, so nobody’s running the live version through this exact binary. Development builds tell a different story though, with real credentials baked in at compile time, which points to a model where a developer builds custom versions for paying operators, credentials-as-a-service, basically, with the AI orchestration as the selling point.
There is also a trail pointing to the developer. Artifacts found in the malware connect the person behind it to carding forum posts dating back to 2025. That suggests this is not just an academic proof of concept created in a lab. It appears to come from someone already involved in cybercrime and testing how much autonomy AI can add to their existing activities.
That doesn’t make the malware impossible to stop. It relies on commercial AI APIs, which can rate-limit requests, reject them, or return responses that don’t match the expected format. Its predictable tie-breaking also makes it easier to identify.
Talos recommends watching for Windows binaries that contact several AI providers and Discord within a short period while also accessing LSASS or creating suspended processes. None of these signs is enough on its own, but seeing them together is highly unusual.
“CLOSEDQUORUM is an early and limited example, but it makes an emerging threat model concrete and gives defenders an outline of the observable signals they can begin addressing today.” concludes the report. “As effort displacement expands across more phases of an intrusion, its effects will compound with the speed and scale already afforded by modern AI. “
Talos technical writeup includes the YARA rule and the MITRE ATT&CK mapping.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, malware)