Cisco Talos has analyzed a Windows Trojan called CLOSEDQUORUM that allows four commercial AI models to vote on its next attack step by majority decision. The malware, which is about 16 megabytes in size, queries DeepSeek, Qwen, Mistral, and Google Gemini in parallel and autonomously executes the chosen action. Talos has not yet demonstrated its use in the wild.
Malware lets four AI providers vote on attack steps
The 64-bit Windows Trojan, written in Go, first collects the computer name, operating system version, and administrator rights of the infected system. CLOSEDQUORUM fills this information into a fixed system prompt that instructs the models to provide only executable decisions and sends the request to DeepSeek, Qwen, Mistral, and Google Gemini. Each model responds in a fixed JSON format with one of the predefined options. The most common response wins by majority decision; in the event of a tie, DeepSeek decides first, followed by Qwen, Mistral, and finally Gemini. The compilation timestamp found in the program code is dated June 17, 2026 – suggesting the malware has likely been circulating for at least three months before Talos made it public on September 22, 2026.
Among the predefined actions the AI models can choose from is the simultaneous theft of Windows credentials from the memory of the LSASS system process, stored passwords from the browsers Chrome, Edge, and Firefox, as well as crypto wallets like MetaMask, Exodus, and Ethereum clients. For deeper system intrusions, the malware generates shellcode and injects it into running processes via process hollowing or Early Bird APC injection. To maintain a persistent presence, it uses registry autostart entries, scheduled tasks, and WMI event subscriptions. CLOSEDQUORUM encrypts stolen data with AES-256-GCM and exfiltrates it from the network via a Discord webhook.
Talos releases hunting tool CAIRN against AI malware
Along with the analysis, Talos released the open-source tool CAIRN (Cognitive Artifact Intelligence Research Network), which specifically searches for AI-driven malware based on metadata patterns. The publicly circulating version of the program is not operational: it contains only placeholder API keys and a non-functional Discord webhook address. Whether CLOSEDQUORUM has ever been used against real victims is independently unverified – solid evidence for that is currently entirely lacking. Code traces link the developer to underground forum posts about the trade of stolen credit card data dating back to 2025.
For detection, The Hacker News, citing Talos, advises against blocking access to AI services outright, since legitimate software also uses them, and recommends watching for behavioral patterns instead: parallel requests to multiple AI providers from unusual Windows programs, LSASS accesses, new persistence mechanisms, and Discord traffic at random five-to-15-minute intervals. Talos provides the Snort rule 1:66984 as well as YARA signatures for this purpose. Full effectiveness, according to the researchers, often additionally requires TLS inspection of network connections, since the queries can otherwise hardly be distinguished from the traffic of legitimate AI applications.
The fact that CLOSEDQUORUM uses off-the-shelf AI services instead of its own attacker infrastructure fits a pattern security researchers have been warning about for some time: just in August, OpenAI, Anthropic, and more than a hundred other companies signed an open letter calling for more investment in defenses against AI-assisted attacks, and Chinese hacker groups, according to the security firm TeamT5, are already relying heavily on DeepSeek for exploit code. It remains to be seen whether CLOSEDQUORUM stays an isolated experiment or becomes a template for a new generation of AI-driven malware – and whether the four providers it uses will start catching abuse patterns like parallel queries to multiple competitors before malware deploys them in the wild.
