This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
A new Windows malware, CLOSEDQUORUM, leverages AI models to make decisions about its malicious actions, rather than relying on a traditional command-and-control server. Developed by a threat actor linked to carding forums, the malware steals credentials, injects code, and establishes persistence, all while communicating with the attacker via a Discord webhook. The AI models, including DeepSeek, Qwen, Mistral, and Google Gemini, vote on whether to steal data, inject code, or establish persistence. This represents an early and limited example of attackers using AI to guide their attacks, and is a significant shift from traditional malware techniques.
A new Windows malware, CLOSEDQUORUM, is utilizing AI models to dictate its malicious behavior, bypassing traditional command-and-control structures. Cisco Talos discovered the malware in June 2026, and released CAIRN, a tool to hunt for similar malware. The malware is at least three months old, linked to criminal forum posts about carding dating back to 2025. CLOSEDQUORUM asks up to four commercial AI services – DeepSeek, Qwen, Mistral, and Google Gemini – to decide on its next action.
Instead of a central C2 server, CLOSEDQUORUM sends basic facts about the computer, such as its name, Windows version, and administrator status, to the AI models. The models then vote on one of four actions: steal, inject, persist, and move. If a model votes to steal, the malware dumps the memory of LSASS, copies saved passwords from Chrome, Edge, and Firefox, and data from MetaMask, Exodus, and Ethereum crypto wallets. The ‘inject’ action runs code inside another program using techniques like Early Bird APC injection or process hollowing. The ‘persist’ action sets up three ways for the malware to restart automatically: a value under the current user's Registry Run key, a scheduled task, and a WMI event subscription that starts it every 60 seconds.
Before sending stolen files, the malware encrypts them and splits them into 1,900-byte pieces, posting one piece per second to the attacker's Discord channel via a webhook. The attacker can see each decision and the model's reasoning in a Discord channel. Talos has identified six builds of the malware and published SHA-256 hashes for each. Defenders should look for AI-service traffic from a Windows program not expected to use AI, similar requests to multiple AI providers, prompts containing details about the computer or attack language, process injection, LSASS access, or new persistence, and Discord webhook traffic from the same program or computer. The malware also leaves traces like a Registry value named WindowsUpdate and a PowerShell script at C:\Windows\Temp\wmi.ps1.
Talos has published a Snort rule (1:66984) and a YARA rule to help defenders identify the malware. The YARA rule requires TLS inspection to match the text the malware sends to the AI models. The malware is linked to a threat actor with a history of carding activities.