New ClosedQuorum Windows malware uses AI for attack decisions

Summary

A new Go-based Windows malware named ClosedQuorum is leveraging multiple AI models, including Google Gemini, DeepSeek, Qwen, and Mistral AI, to autonomously make post-compromise attack decisions without human intervention. The malware uses a voting system among the AI models to determine actions such as credential dumping, data exfiltration via Discord webhooks, and persistence. While not confirmed in the wild, its architecture represents a significant shift towards automated attack chains.

Full text

New ClosedQuorum Windows malware uses AI for attack decisions By Bill Toulas September 22, 2026 02:04 PM 0 A new Windows malware named ClosedQuorum uses Google Gemini, DeepSeek, Qwen, and Mistral AI models to autonomously determine the actions to take during post-compromise stages of an attack. The Go-based malware acts with no commands from a human operator, using reconnaissance information and a voting system to decide its next step on infected hosts. When votes are tied, DeepSeek has priority at making the final call, based on the option it considers most appropriate, followed by Qwen, Mistral, and Gemini. Cisco Talos researchers analyzing ClosedQuorum say that the models are restricted to a predefined set of decisions, including: steal — simultaneously runs LSASS credential dumping, browser (Chrome, Edge, Firefox) credential theft, and cryptocurrency-wallet (MetaMast, Exodus, Ethereum) extraction inject — generates shellcode, then uses either process hollowing or Early Bird APC injection persist — executes the malware’s persistence module move — included as a possible lateral movement decision, but the analyzed distribution build has no corresponding handler, so it cannot execute this action The stolen details are then passed to the operators via a Discord webhook, so apart from the malware delivery, the attack can be fully automated. ClosedQuorum attack model overviewSource: Cisco Talos describes ClosedQuorum as the first publicly documented Windows implant to delegate tactical command-and-control (C2) decisions to a panel of AI models, commenting that this adds greater speed and scaling potential to malicious operations. The researchers also highlight that this eliminates human interaction, allowing the attack chain to proceed at any time. However, Cisco notes that this may also pose challenges in certain cases where rate limits are hit, output is malformed, or commercial APIs that the system relies on are temporarily unavailable. Since it is not a sophisticated piece of malware, it is unclear if ClosedQuorum is a test or experiment. However, the researchers warn that it represents an "architectural shift towards attack-chain automation." “While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025,” explains Cisco Talos. The binary that Cisco Talos analyzed contains placeholder API credentials and a dummy Discord webhook, although the creators can add those in their custom ClosedQuorum builds. Cisco Talos discovered ClosedQuorum through CAIRN, an open-source toolkit it released to help researchers track and analyze AI-integrated malware. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: New RatHat Android malware uses AI to automate device controlOpenAI details more cases of AI agents taking unauthorized actionsAnthropic wants Claude to analyze your bank account and financial dataSpain's data agency gets first report of AI-powered data breachHackers abused Claude to extract secrets from 1.8M Android apps

Indicators of Compromise

• malware — ClosedQuorum

Entities