Cisco Talos has uncovered a Windows malware implant that uses commercial AI models to help decide what it should do after compromising a system.
Called CLOSEDQUORUM, the malware asks DeepSeek, Qwen, Mistral, and Google Gemini to vote on actions including credential theft, persistence, and code injection. Talos describes it as the first publicly documented Windows implant, to its knowledge, to use this kind of AI-driven decision process for tactical command and control.
Talos has not confirmed CLOSEDQUORUM in real-world attacks. The publicly distributed sample contains placeholder AI API keys and a dummy Discord webhook, so researchers did not observe it operating end to end. Static analysis confirmed the decision loop, while development builds showed provider credentials could be inserted at compile time.
The design follows a broader rise in AI supporting real-world intrusion activity while retaining familiar endpoint behaviors defenders can hunt.
How CLOSEDQUORUM turns AI votes into attack actions
Cisco Talos described CLOSEDQUORUM as the first publicly documented Windows implant, to its knowledge, to use this model for tactical command and control. The 16.4 MB, 64-bit Go executable collects host information and submits it to as many as four LLM providers.
Each model chooses from a fixed menu: steal, inject, persist, or move. The public build has no handler for move, leaving three executable actions. CLOSEDQUORUM executes the action with the most votes; the models do not devise new attack techniques.
When steal wins, the malware dumps LSASS memory for Windows credentials, collects saved passwords from Chrome, Edge, and Firefox, and searches for MetaMask, Exodus, and Ethereum wallet data. The recently disclosed PEEP malware similarly targets Chromium browsers for credential theft and session hijacking.
CLOSEDQUORUM encrypts stolen data with AES-256-GCM, Base64 encodes it, and sends it through an operator-controlled Discord webhook. It also supports process injection and persistence through Registry Run keys, scheduled tasks, and permanent Windows Management Instrumentation event subscriptions.
Detection hinges on behavior, not AI traffic alone
Commercial AI services carry legitimate traffic, so connections to model providers are weak indicators by themselves. Talos recommends correlating them with LSASS access, process injection, persistence, Discord webhook communication, and activity at randomized five-to-15-minute intervals. That timing can reduce exposure to short-lived automated analysis, a broader problem as malware adapts around sandboxes.
Organizations can tighten detection and prevention with several controls:
- Restrict untrusted code execution. Use application control or allowlisting to limit systems to approved applications and code.
- Harden credential protections. Use Credential Guard and LSA protection on supported systems, reduce local administrator rights, and keep privileged credentials out of browsers on general-purpose endpoints.
- Control outbound AI and Discord traffic. Limit access to approved applications and investigate unexpected processes contacting several AI providers or Discord webhooks.
- Correlate endpoint and network signals. Hunt for LSASS access, process injection, WMI or scheduled-task persistence, AI API traffic, and recurring five-to-15-minute activity.
- Monitor persistence and telemetry tampering. Alert on unusual Run keys, permanent WMI subscriptions, scheduled tasks, and attempts to interfere with Event Tracing for Windows.
- Test incident response plans for credential theft. Exercises should cover endpoint isolation, LSASS investigation, credential resets or token revocation, browser and wallet exposure, and suspicious outbound communications.
CLOSEDQUORUM surfaced through Talos' CAIRN research framework. WIRED reported that researcher Ryan Fetterman identified roughly 20 additional examples of AI-integrated malware while developing CAIRN, although those samples should not be assumed to operate autonomously like CLOSEDQUORUM.
The finding does not establish a widespread autonomous-malware campaign. It shows that current AI services can take over a bounded part of attack decision-making while credential access, persistence, process injection, and exfiltration remain observable detection points
Want to learn more AI tips, tricks, and prompting techniques? Let us teach you How to Talk to AI for free! Try our six-minute course at The Neuron Academy and learn a few simple ways to write better prompts and get more useful results from AI, or browse our other AI course for free for seven days. Check out all the lessons here →.