Cisco Talos researchers identified new Windows malware called ClosedQuorum that uses multiple artificial intelligence models to determine the next step after compromising a device, without waiting for direct instructions from a human operator. The malware, written in Go, relies on reconnaissance information collected from the infected device and then asks Google’s Gemini, DeepSeek, Qwen, and Mistral models to weigh the appropriate action.
The decision-making mechanism includes a voting system among the models. When the votes are tied, DeepSeek has priority, followed by Qwen, Mistral, and Gemini. The models are not free to execute arbitrary commands, as the malware limits their choices to a specific set of actions.
What Can ClosedQuorum Do?
- steal: Run tools to extract LSASS credentials and steal credentials from Chrome, Edge, and Firefox browsers, in addition to cryptocurrency wallet data, including MetaMask, Exodus, and Ethereum.
- inject: Generate shellcode and inject it using process hollowing or Early Bird APC injection.
- persist: Run a dedicated module to ensure the malware persists on the device.
- move: An option intended for lateral movement, but it does not work in the version analyzed by the researchers because the corresponding handler is missing.
The stolen data is sent to the operators through a Discord webhook. Thus, after the malware has been delivered to the device, large parts of the attack chain can continue automatically.
Why Does This Matter?
Cisco Talos describes ClosedQuorum as the first publicly documented Windows hacking malware to delegate tactical command-and-control decisions to a group of artificial intelligence models. In practice, this means that an attacker may not need to monitor every infected device or make a separate decision for each step, increasing operational speed and scalability and enabling activity to continue outside working hours.
However, the design has weaknesses. Decisions may fail when the models’ usage limits are reached, when the models produce invalid outputs, or when the commercial application programming interfaces on which the malware relies stop operating. The version examined by the researchers also contained fake API credentials and a test Discord webhook, with the possibility of replacing them in customized versions.
Confirmed Threat or Experiment?
The researchers do not consider ClosedQuorum technically advanced, and they have no confirmation that it has actually been used in widespread attacks. It is also unclear whether it is an experimental model or a testing project. Nevertheless, artifacts inside the executable linked the malware’s developer to posts on criminal forums associated with card-stealing operations, dating back to 2025.
Cisco Talos discovered the malware through CAIRN, open-source tools it launched to help researchers track and analyze malware that integrates artificial intelligence. Based on the available information, ClosedQuorum does not constitute evidence of fully autonomous attacks becoming widespread, but it provides a documented example of artificial intelligence moving from an assistant’s role to an element involved in selecting attack tactics.