CLOSEDQUORUM Malware Uses AI Models to Decide Attack Actions

A Windows malware called CLOSEDQUORUM is designed to use a vote from up to four artificial intelligence models to decide what actions it should take instead of relying entirely on a traditional attacker-controlled command-and-control server.

Cisco Talos disclosed the malware on September 22, 2026, describing it as an early example of a Windows implant that delegates parts of its command-and-control decision-making to commercial AI services.

The AI models can select actions designed to steal Windows credentials, saved browser passwords, and cryptocurrency wallet data. However, Talos has not observed the complete attack process operating successfully from beginning to end, and the publicly available version of CLOSEDQUORUM is not functional as-is.

How the AI Voting System Works

Traditional malware generally receives commands from an attacker-controlled C2 server. CLOSEDQUORUM takes a different approach by querying up to four commercial AI services:

  • DeepSeek
  • Qwen
  • Mistral
  • Google Gemini

Each request includes basic information about the infected Windows system, such as:

  • Computer name
  • Windows version
  • Administrator status

The malware also provides the AI models with a predefined list of actions.

The available actions are:

  • Steal
  • Inject
  • Persist
  • Move

The publicly available version does not contain functional code for the Move action, meaning that selecting it does not result in an operation.

Each AI model must respond using a predefined format. Invalid responses are discarded, and CLOSEDQUORUM counts the remaining responses.

The action receiving the most votes is then selected for execution.

If the models fail to provide a usable response, the malware does not automatically choose an action. Instead, it waits and attempts the process again.

This architecture means an attacker does not necessarily need to send individual commands after the malware has been deployed. The AI services can determine which predefined operation should be performed.

Discord Is Still Used for Monitoring and Data Theft

Although the malware delegates decision-making to AI services, it still communicates with the attacker through Discord.

Before executing an action, CLOSEDQUORUM sends the AI responses and their stated reasoning to a Discord channel through a webhook.

Stolen information is also sent to the same Discord channel.

For the malware to operate, each build requires API keys for the AI services and a valid Discord webhook. Development versions indicate that these values are embedded during compilation.

The publicly available sample contains placeholder values, meaning it cannot communicate with the AI services or send stolen information without being configured.

What the Malware Can Do

Credential and Wallet Theft

When the AI vote selects the Steal action, CLOSEDQUORUM attempts several forms of credential theft.

The malware can:

  • Dump LSASS memory to obtain Windows authentication credentials
  • Extract saved passwords from Chrome
  • Extract saved passwords from Edge
  • Extract saved passwords from Firefox
  • Search for MetaMask wallet data
  • Search for Exodus wallet data
  • Target Ethereum cryptocurrency wallet information

Process Injection

The Inject action allows the malware to execute code inside another process.

Talos observed support for Early Bird APC injection and process hollowing techniques.

These techniques can allow malicious code to operate within another process rather than running entirely as a separate executable.

Persistence

The Persist action provides several mechanisms for automatically restarting the malware.

CLOSEDQUORUM can use:

  • A WindowsUpdate value under the current user's Registry Run key
  • A scheduled task
  • A permanent WMI event subscription

The Registry and WMI persistence mechanisms use Windows Update-related naming to make the activity appear more legitimate.

The WMI mechanism is configured to start the malware every 60 seconds.

How Stolen Data Is Prepared for Exfiltration

Before sending stolen files, CLOSEDQUORUM copies them into:

C:\Windows\Temp\

The files are then encrypted and divided into approximately 1,900-byte chunks.

The malware sends the chunks to the attacker's Discord channel at a rate of approximately one chunk per second.

Limitations of the Public Sample

Despite the unusual AI-driven design, the publicly available version of CLOSEDQUORUM is not immediately operational.

The sample contains placeholder API credentials and Discord webhook information.

Talos also has not observed the complete attack chain successfully operating from initial infection through AI decision-making and final execution in a real-world victim environment.

The researchers therefore describe CLOSEDQUORUM as an early and limited example of AI-assisted malware rather than evidence of a fully autonomous attack platform.

The approach also introduces dependencies that traditional malware does not necessarily have.

For example, the malware depends on external AI services that can:

  • Reject requests
  • Rate-limit requests
  • Return unexpected responses
  • Change their behavior or availability

This means the malware relies partly on infrastructure controlled by third-party AI providers.

How CLOSEDQUORUM Differs From Earlier AI Malware

AI has previously been incorporated into malware operations.

For example, LAMEHUG, reported by Ukraine's CERT-UA in July 2025, used an AI model to generate commands for tasks already defined by the malware.

CLOSEDQUORUM uses AI differently.

Instead of asking an AI model to generate commands, it asks multiple models to select which predefined action should be executed.

This creates a voting-based decision system where several AI services independently provide an answer before the malware chooses the action with the highest number of votes.

Detection and Hunting

Talos recommends focusing on behavior rather than simply blocking individual AI-service domains.

Legitimate applications can communicate with services such as DeepSeek, Mistral, Gemini, Discord, or OpenRouter.

However, a Windows application that contacts several AI providers while simultaneously accessing LSASS, injecting code into processes, creating WMI persistence, or communicating through a Discord webhook would be considerably more suspicious.

Potential indicators include:

  • AI-service traffic from software that normally has no reason to use AI
  • Requests sent to multiple AI providers within a short period
  • AI prompts containing detailed information about the local Windows system
  • Process injection activity
  • LSASS access
  • New persistence mechanisms
  • Discord webhook communication
  • Repeated activity at random intervals of approximately five to 15 minutes

Talos also published a Snort rule, 1:66984, designed to detect CLOSEDQUORUM's AI prompts.

Because the prompts may be visible only after HTTPS traffic is decrypted, TLS inspection may be required for network-based detection.

A YARA rule was also published for malware hunting, particularly within file-analysis environments.

Known Malware Hashes

Talos identified six SHA-256 hashes associated with CLOSEDQUORUM development builds:

250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7

c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7

c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f

f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c

5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb

eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5

Additional Indicators

Other artifacts associated with CLOSEDQUORUM include:

Registry

WindowsUpdate

under the current user's Registry Run key.

PowerShell script

C:\Windows\Temp\wmi.ps1

WMI persistence

A permanent WMI event subscription using Windows Update-themed names that launches the malware every 60 seconds.

Key Takeaway

CLOSEDQUORUM represents a different approach to malware command and control by allowing multiple AI models to vote on predefined attack actions.

The malware is still an early-stage and limited implementation, and the publicly available sample is not operational without additional configuration. However, its design shows how AI services can potentially be incorporated into malware decision-making, while traditional components such as Discord remain available for monitoring and data exfiltration.

For defenders, the strongest detection opportunity is the combination of AI-service communication, credential access, process injection, persistence, and Discord webhook activity rather than any single indicator alone.