**Cisco Talos** recently uncovered **CLOSEDQUORUM**, a Windows-based malware designed to receive its directives from a consensus of up to four distinct AI models. This innovative approach moves away from traditional command-and-control (C2) servers, presenting a new challenge for cybersecurity professionals. While **Talos** has not observed a fully operational instance of this setup in the wild, and the publicly available version of the malware is non-functional, its underlying architecture represents a significant shift. The AI models are programmed to choose from actions such as stealing Windows credentials, saved browser passwords, and cryptocurrency wallet data. **Talos** discovered **CLOSEDQUORUM** using **CAIRN**, an open-source tool released concurrently to track malware integrating AI services. Analysis of the malware's code indicates it has been in development for at least three months. Researchers noted links between the malware's developer and criminal forum discussions related to carding, the illicit trade of stolen card data. ### How the AI Vote Works Unlike conventional malware that relies on an attacker's C2 server, **CLOSEDQUORUM** queries up to four commercial AI services: **DeepSeek**, **Qwen**, **Mistral**, and **Google Gemini**. Each request includes basic system information, such as the computer's name, **Windows** version, and administrator status, along with a predefined list of actions. The available actions are `steal`, `inject`, `persist`, and `move`. In the current public iteration, the `move` action lacks any corresponding code and is thus inert. Each AI model's response must adhere to a specific format; otherwise, it is discarded. The malware then tallies the valid responses and executes the action that receives the most votes. If no model provides a usable answer, the malware enters a waiting state and attempts the process again, rather than defaulting to an action. This design allows the attacker to maintain a degree of autonomy once the malware is active, eliminating the need for continuous manual command issuance. However, the attacker still monitors each decision and its rationale via a **Discord** channel, where the malware posts updates through a **Discord** webhook before executing an action. Stolen data is also exfiltrated to the same channel. For **CLOSEDQUORUM** to function, each instance requires valid API keys for the AI services and a legitimate **Discord** webhook. Test versions embed these keys during the build process, while the public version contains placeholders, rendering it incapable of interacting with AI models or exfiltrating data.  **Talos** believes **CLOSEDQUORUM** is the first publicly documented **Windows** implant to delegate C2 decisions to AI models. Previous instances, such as **LAMEHUG** reported by **CERT-UA** in July 2025, used AI to generate commands for pre-defined tasks, whereas **CLOSEDQUORUM** tasks the AI with selecting the task itself. **Talos** views **CLOSEDQUORUM** as an early, albeit limited, example of attackers integrating AI models into their attack methodologies. This reliance on external AI services introduces potential vulnerabilities, as services may refuse requests, impose rate limits, or return malformed output. Furthermore, the malware's operation is dependent on third-party companies beyond the attacker's control. ### What the Actions Do When the AI models vote for `steal`, the malware simultaneously performs three actions: * Dumps the memory of **LSASS**, the **Windows** process holding login credentials. * Copies saved passwords from **Chrome**, **Edge**, and **Firefox**. * Extracts data from **MetaMask**, **Exodus**, and **Ethereum** crypto wallets. Choosing `inject` causes the malware to execute code within another program, primarily utilizing **Early Bird APC** injection or process hollowing if specifically requested by the model. The `persist` action establishes three methods for automatic re-execution: * A **Registry Run** key value named `WindowsUpdate` under the current user's profile. * A scheduled task. * A **WMI** event subscription that restarts the malware every 60 seconds. Both the **Registry** value and **WMI** names are themed to resemble legitimate **Windows Update** activity. Before exfiltrating stolen data, the malware copies files to `C:\Windows\Temp\`, encrypts them, and fragments them into 1,900-byte pieces. Each piece is then posted to the attacker's **Discord** channel one per second. ### What Defenders Can Look For **Talos** advises defenders to focus on behavioral indicators rather than attempting to block the domains of the AI services, as legitimate applications may also communicate with **DeepSeek**, **Mistral**, **Gemini**, **Discord**, or **OpenRouter**. However, an application simultaneously contacting multiple AI providers while also accessing **LSASS**, injecting code into suspended processes, or creating **WMI** persistence is highly suspicious. While no single indicator definitively identifies the malware, the combination of these behaviors is distinctive. Key signs include: * AI-service traffic originating from an unexpected **Windows** program. * Multiple, similar requests sent to various AI providers within a short timeframe. * Prompts containing system details or attack language, potentially visible only through **TLS** inspection (decrypting HTTPS traffic) or to the AI provider. * Evidence of process injection, **LSASS** access, or new persistence mechanisms. * **Discord** webhook traffic from the same program or computer. * Repeated activity at random intervals of five to 15 minutes. **Talos** has published **Snort** rule `1:66984` to detect the malware's prompts to AI services. This rule will likely require **TLS** inspection to be effective. A **YARA** rule has also been released, primarily for scanning file data on platforms like **VirusTotal**. As of September 23, the **CAIRN** rule file did not include a specific **CLOSEDQUORUM** rule, requiring **CAIRN** users to manually add **Talos**'s rule. **Talos** has provided the following **SHA-256** hashes for six development builds of the malware: * **SHA-256**: `250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7` * **SHA-256**: `c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7` * **SHA-256**: `c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f` * **SHA-256**: `f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c` * **SHA-256**: `5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb` * **SHA-256**: `eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5` Additional forensic traces left by the malware include: * **Registry**: A value named `WindowsUpdate` under the current user's **Run** key. * **File**: A **PowerShell** script consistent with `C:\Windows\Temp\wmi.ps1`. * **WMI**: A permanent event subscription with **Windows Update**-themed names, designed to launch the malware every 60 seconds.