CLOSEDQUORUM Malware Uses AI Hive Mind to Autonomously Select Attack Moves
10 Sources
[1]
A New Tool Found Malware That's Guided by an AI Hive Mind -- No Humans in Sight
For years, cybersecurity practitioners have tracked different types of malware and detected potential infections using digital fingerprints to identify different hacking tools and follow their use over time. As attackers are increasingly incorporating agentic AI components into their hacking tools,
[2]
Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions
A new Windows malware called CLOSEDQUORUM can query up to four LLM providers - Google Gemini, DeepSeek, Qwen, and Mistral - to autonomously select from predefined post-compromise actions, including stealing users' credentials and cryptocurrency wallets. Once deployed, the malware does not require
[3]
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker's server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data. Talos has not seen this setup
[4]
New ClosedQuorum Windows malware uses AI for attack decisions
A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. The Go-based malware acts with no commands from a human operator, using reconnaissance information and a
[5]
Researchers found malware that uses four different AI chatbots to run itself
Serving tech enthusiasts for over 25 years. TechSpot means tech analysis and advice you can trust. Looking ahead: Researchers at Cisco Talos have found a Windows malware tool that uses several large language models to help decide what to do on a compromised machine. Its discovery points to a
[6]
Cisco Talos finds malware that puts its next move to a four-model vote
Cisco Talos finds malware that puts its next move to a four-model vote Cisco Systems Inc.'s Talos Threat Intelligence group today released an open-source toolkit for hunting malware that has artificial intelligence built into it. The first sample it has detailed is a Windows credential stealer
[7]
Researchers found malware that lets AI models vote on how to attack you
Security researchers at Cisco Talos have documented what they describe as the first publicly known Windows malware to hand its tactical decisions to a panel of commercial AI models rather than a human operator. The malware, called CLOSEDQUORUM, queries up to four AI services, DeepSeek, Qwen,
[8]
New malware lets AI models decide how to attack
Cisco Talos said it has identified a new malware strain called CLOSEDQUORUM that uses a panel of large language models to decide its next actions without human direction. The malware is designed to steal login credentials and cryptocurrency wallets, and after deployment it delegates action
[9]
Researchers Just Discovered New Malware That Lets a Panel of LLMs Decide How to Attack
A group of cybersecurity researchers working on a tool for hunting AI-powered malware made a startling discovery. In a blog post published on Tuesday, they described a novel type of malware with "fully autonomous command and control" that takes instruction from a panel of large language models,
[10]
CLOSEDQUORUM: New AI Malware Can Decide its Next Move Using Multiple Models
Cybersecurity researchers have identified a Windows malware program that uses multiple artificial intelligence models to decide what to do next, pointing to a new direction in the evolution of AI-assisted cyber threats. Researchers at Cisco Talos analyzed the malware, called CLOSEDQUORUM. Unlike
Share
Copy Link
Cisco Talos uncovered CLOSEDQUORUM, a Windows malware that queries up to four AI models—DeepSeek, Qwen, Mistral, and Google Gemini—to autonomously determine its next actions. The malware operates without human commands, using a voting system among large language models to decide whether to steal credentials, inject code, or establish persistence on infected systems.
CLOSEDQUORUM Malware Delegates Attack Decisions to AI Models
Cisco Talos discovered CLOSEDQUORUM, a Windows malware that represents a significant shift in how attackers are operationalizing AI-integrated malware
1
. Unlike traditional malware that relies on command-and-control servers, this Go-based malware queries up to four large language models—DeepSeek, Qwen, Mistral, and Google Gemini—to autonomously select post-compromise actions2
. The malware uses AI models to vote on its next move, with DeepSeek taking precedence in tied votes, followed by Qwen, Mistral, and Google Gemini3
. This autonomous malware operates in a closed session with no mechanism for human input once deployed, creating what researchers describe as an AI hive mind directing the attack1
.How the Voting System Works
The malware sends basic reconnaissance information about the infected computer to each AI model, including the computer name, Windows version, and administrator status
3
. Each model receives a system prompt instructing it: "You are an advanced malware strategist"2
. The models must choose from predefined actions and respond in a set format, or their answers are discarded3
. CLOSEDQUORUM tallies the votes and executes the action with the most support, continuing operations even if one AI service becomes unavailable4
. Before acting, the malware posts each decision and the model's stated reasoning to a Discord channel via a Discord webhook3
.Predefined Attack Capabilities
The AI models can select from four capability modules built into CLOSEDQUORUM malware
2
. The "steal" action simultaneously dumps LSASS memory for Windows credentials, extracts saved browser passwords from Chrome, Edge, and Firefox, and harvests cryptocurrency wallet data from MetaMask, Exodus, and Ethereum wallets4
. The "inject" option generates shellcode and executes it using process hollowing or Early Bird injection techniques2
. The "persist" module establishes three methods for automatic restart: a Registry Run key value, a scheduled task, and a WMI event subscription that triggers every 60 seconds3
. Stolen credentials land in the operator's Discord channel, encrypted with AES-256-GCM using a daily rotating key derived from the message timestamp2
.CAIRN Framework Reveals Broader AI Malware Landscape
Cisco Talos discovered CLOSEDQUORUM using CAIRN (Cognitive Artifact Intelligence Research Network), a new open-source framework released to help security researchers track and classify AI-integrated malware
4
. Ryan Fetterman, the Cisco Talos researcher who led CAIRN development, initially identified only nine named malware families incorporating AI when he began the project1
. After developing CAIRN over several months, Fetterman discovered approximately 20 additional examples of AI-integrated malware, revealing a landscape far more complex than publicly reported5
. The framework identifies AI integration fingerprints left in malware metadata and uses these signals to classify samples and track emergent behaviors1
.Related Stories
From Productivity Tool to Operational Infrastructure
Matt Olney, senior director of threat intelligence at Cisco Talos, emphasized that AI is shifting from a productivity tool to operational infrastructure for attackers
5
. This transition enables attackers to run more campaigns, target more systems, and handle different computers simultaneously through autonomous command-and-control systems1
. The evolution began with LAMEHUG, malware that Ukraine's CERT-UA reported in July 2025, which communicated with Qwen2.5-Coder-32B-Instruct through a Hugging Face API to receive commands1
. CLOSEDQUORUM represents the next step, where large language models don't just execute predefined tasks but actively choose the attack strategy3
.Detection Strategies and Real-World Implications
Cisco Talos has not confirmed in-the-wild deployment of CLOSEDQUORUM malware, though artifacts link the developer to cybercrime forums discussing carding activities dating back to 2025
4
. Defenders should focus on behavioral characteristics rather than domain blocking, since legitimate applications may contact DeepSeek, Mistral, Google Gemini, or Discord independently2
. Watch for programs contacting multiple AI services while accessing LSASS, performing shellcode injection, or creating WMI persistence2
. The malware's reliance on commercial AI services creates vulnerabilities through rate limits, malformed output, or temporary API unavailability4
. However, the architectural shift toward attack-chain automation signals where cybersecurity threats are heading, as human operators are no longer bound by attention spans, working hours, or cognitive load when AI systems can execute attack phases autonomously2
.References
Summarized by
Navi
[2]
[4]
Related Stories
Google Discovers AI-Powered Malware in the Wild, But Experts Question Real-World Threat Level
05 Nov 2025•Technology
AI agent executes first fully autonomous ransomware attack, lowering barrier for cybercriminals
01 Jul 2026•Technology
NYU Researchers Develop AI-Powered 'Ransomware 3.0', Sparking Cybersecurity Concerns
04 Sept 2025•Technology
Recent Highlights
1
Meta Unveils Muse Wonder Frontier AI Models, Claims Performance Matching OpenAI and Anthropic
Technology
2
IMF Report Warns AI Market Correction Could Spark Global Financial Crisis With $1.4T at Risk
Business and Economy
3
Eight States Sue OpenAI Over ChatGPT Safety Concerns and Unlawful Collection of Children's Data
Policy and Regulation
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
