The Pulse
Cisco Talos Finds Malware That Lets AI Pick the Next Attack
Cisco Talos identified CLOSEDQUORUM, a Windows malware sample that uses multiple commercial AI models to select bounded attack actions, though the publicly available binary is non-functional and has not been linked to an active campaign.
AI.info Team ·
Cisco Talos has identified a Windows malware sample that delegates tactical decisions to commercial artificial-intelligence models, but the discovery comes with an important qualification: researchers have not confirmed that the implant has operated in the wild. The publicly observed binary contains placeholder API keys and a dummy Discord webhook, making it non-functional as distributed.
Talos describes the malware, named CLOSEDQUORUM, as the first publicly documented Windows implant known to apply an AI decision loop to command and control. The company says the sample can ask up to four large language models to choose among a constrained set of attack actions, then execute the winning decision without continued instructions from a human operator. The research was published on September 22, 2026, alongside the release of Talos’s open-source CAIRN toolkit for tracking AI-integrated malware.
The distinction between a working criminal tool and a technical demonstration matters. Talos says artifacts in the binary link its developer to criminal-forum postings related to carding dating back to 2025, but the company does not claim that CLOSEDQUORUM has been deployed against victims. The finding establishes an architecture and a working decision mechanism, not a confirmed campaign.
“CLOSEDQUORUM is best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift towards attack-chain automation is coming.”
Ryan Fetterman, security researcher, Cisco Talos
Four models replace a conventional C2 server
Traditional command-and-control infrastructure gives an operator a server, domain or address through which to issue instructions. CLOSEDQUORUM instead treats model providers as part of its control system. Talos says the implant can query DeepSeek, Qwen, Mistral and Google Gemini in sequence, collect their decisions and select the action with the most votes.
The malware is a 16.4-megabyte, 64-bit Windows executable written in Go. Its model-orchestration code sends each provider host information and attack context, then parses the response into a structured decision. The available choices include steal, inject, persist and move; the distribution build has no handler for move.
Voting is deliberately narrow. The models do not return unrestricted instructions that the implant can interpret as arbitrary code. They must produce a valid object matching the malware’s expected schema, and the selected decision must correspond to a capability already implemented in the binary. Talos says the design compresses a tactical phase of an intrusion into a small set of executable options.
CLOSEDQUORUM targets credentials and wallets
The steal action combines three functions: dumping credentials from Windows LSASS memory, extracting saved passwords from Chrome, Edge and Firefox, and searching for cryptocurrency-wallet data. Talos also found code for process injection, persistence and payload generation.
The implant collects the hostname, Windows version, processor count, system architecture and administrator status before sending that context to the model panel. A target process can refresh during later decision cycles. The model response includes a reasoning field and execution parameters, which the malware sends to an operator through a Discord webhook along with the winning decision and telemetry.
Talos says stolen data is encrypted with AES-256-GCM and delivered to Discord as base64-encoded blocks. The report describes the encryption as obfuscation rather than a firm separation between the developer and the operator: the key is derived from the current date, meaning the developer could theoretically decrypt an operator’s exfiltrated material.
The public sample is an inert template
The sample available to researchers does not contain working credentials. Its model API values are initialized to dummy_api_key, and its Discord destination is set to dummy_webhook_url. Talos says development builds show that the developer could compile customized copies with an operator’s API keys and webhook inserted at build time.
That arrangement suggests a service model in which a developer supplies configured malware while operators handle delivery. Talos describes the inferred setup as credentials-as-a-service, with autonomous model orchestration serving as the product’s distinguishing feature. The assessment is explicitly presented as an inference from the available builds, not as proof of a confirmed deployment structure.
The binary also contains several mechanisms intended to make analysis harder, including randomized polling intervals and techniques associated with process injection and persistence. Those features increase the sample’s technical interest, but they do not change Talos’s central caveat: no complete end-to-end execution was observed from the public distribution build.
Defenders must watch for the combination
Talos advises defenders to focus on correlated behavior rather than blocking a single domain or provider. Legitimate software may contact an AI service or Discord, but a Windows executable that contacts several model providers while accessing LSASS, injecting into suspended processes or creating persistence is a more distinctive signal.
The company identifies several behaviors for detection: short-interval requests to multiple AI providers, structured prompts containing host information or offensive capability terms, Discord webhook activity from the same process, and repeated execution at randomized five-to-fifteen-minute intervals. Provider-side telemetry or TLS inspection may be needed to see the prompts themselves.
CLOSEDQUORUM also exposes weaknesses in the approach. Model refusals, API limits, malformed responses and unavailable providers can interrupt the decision loop. If the models tie, Talos found that the implementation resolves the result in provider order, with DeepSeek receiving priority, followed by Qwen, Mistral and Gemini.
CAIRN turns one sample into a tracking problem
Talos released CAIRN as an open-source toolkit for tracking AI-integrated malware. The company says the project will examine samples ranging from experimental proofs of concept to potentially active campaigns.
For now, CLOSEDQUORUM is best treated as a documented reference case rather than evidence of a broad attack wave. Its importance lies in showing that an implant can convert model output into bounded tactical actions without requiring an operator to issue every command. The available sample may be inert, but the decision loop, provider integrations and defensive indicators are concrete enough for security teams to test against now.