A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker’s server, Cisco Talos said on September 22.
The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup work from start to finish, and the public version of the malware does not work as it is.
Talos found the malware with CAIRN, an open-source tool it released the same day to hunt for malware that uses AI services. The malware is at least three months old, because Talos’s analysis of the code is dated June 17, 2026.
The researchers did not describe how the malware would get onto a victim’s computer. It said clues in the code tied the developer to criminal forum posts about carding, the trade in stolen card data, dating to 2025.
How the AI Vote Works
Malware usually takes orders from a command-and-control (C2) server that the attacker runs. CLOSEDQUORUM instead asks up to four commercial AI services what to do: DeepSeek, Qwen, Mistral, and Google Gemini, Talos found.
With each request, the malware sends basic facts about the computer, such as its name, its Windows version, and administrator status. It also sends a fixed list of actions for the models to choose from.
There are four actions: steal, inject, persist, and move. In the public version, move has no code behind it, so picking it does nothing.
Each model must answer in a set format, or its answer is thrown out. The malware counts the answers and carries out the action with the most votes. If no model gives a usable answer, it waits and tries again instead of picking an action by default.
Because the models make each choice, the attacker does not have to send commands once the malware is running, Talos said.
The attacker still sees each decision, along with the model’s stated reason, in a Discord channel. Before it acts, the malware posts them there via a Discord webhook, a URL that sends messages to a channel. Stolen data goes to the same channel.
To work, each copy needs API keys, the codes that let a program use the AI services, and a real Discord webhook. Test versions show that the keys are added when the program is built. The public version has placeholder values for both, so it cannot reach the models or send data.
Talos said CLOSEDQUORUM is, to its knowledge, the first publicly documented Windows implant to hand its C2 decisions to AI models.
AI has been used in malware before. LAMEHUG, which Ukraine’s CERT-UA reported in July 2025, asked an AI model to write commands for tasks set in its code. CLOSEDQUORUM asks the models to choose the task.
Talos calls CLOSEDQUORUM an early and limited example of attackers handing part of an attack to AI models.
Relying on AI services creates weak points, because the services can refuse requests, limit how many they answer, or return broken output. The malware also depends on companies it does not control.
What the Actions Do
When the vote picks steal, the malware does three things at once, Talos found. It dumps the memory of LSASS, the Windows process that holds login credentials. It also copies saved passwords from Chrome, Edge, and Firefox, and data from MetaMask, Exodus, and Ethereum crypto wallets.
The inject choice runs code inside another program. It uses a method called Early Bird APC injection, or process hollowing if the model asks for it.
The persist choice sets up three ways for the malware to start again automatically: a value under the current user’s Registry Run key, a scheduled task, and a WMI event subscription that starts it every 60 seconds. The Registry value and the WMI names are themed on Windows Update so they look like normal system activity.
Before sending stolen files, the malware copies them into C:WindowsTemp, encrypts them, and splits them into 1,900-byte pieces. It posts one piece per second to the attacker’s Discord channel.
What Defenders Can Look For
Talos said defenders should watch for behavior rather than block the domains of the AI services. Legitimate programs may contact DeepSeek, Mistral, Gemini, Discord, or OpenRouter, another AI service that Talos names. Far fewer would contact several of them while also accessing LSASS, injecting code into suspended processes, or creating WMI persistence.
No single sign identifies the malware, but the combination stands out. The signs include:
- AI-service traffic from a Windows program that is not expected to use AI
- Similar requests sent to several AI providers within a short time
- Prompts that contain details about the computer or attack language, which are likely visible only with TLS inspection (decrypting HTTPS traffic) or to the AI provider
- Process injection, LSASS access, or new persistence
- Discord webhook traffic from the same program or computer
- Activity that repeats at random intervals of five to 15 minutes
A Snort rule Talos published, 1:66984, looks for the malware’s prompts to the AI services. Because those prompts are likely visible only with TLS inspection, the rule would likely need TLS inspection to match them.
The YARA rule Talos published is written mainly to search VirusTotal’s data about files. Parts of it, such as the text the malware sends to the AI models, match only when the file itself is scanned.
The rule file that comes with CAIRN did not include a CLOSEDQUORUM rule when The Hacker News checked it on September 23. CAIRN users would need to add Talos’s rule themselves.
Talos published SHA-256 hashes for six builds from the malware’s development:
- SHA-256:
250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7 - SHA-256:
c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7 - SHA-256:
c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f - SHA-256:
f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c - SHA-256:
5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb - SHA-256:
eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5
Other traces the malware would leave on a computer include:
- Registry: a value named
WindowsUpdateunder the current user’s Run key - File: a PowerShell script at a path consistent with
C:WindowsTempwmi.ps1 - WMI: a permanent event subscription with Windows Update-themed names that starts the malware every 60 seconds
