Malware Now Lets AI Pick Its Next Move

A newly documented Windows implant doesn't wait for a human handler to type the next command. It asks a panel of large language models, tallies their answers, and then executes whatever they decide. Cisco Talos, which found the binary, says the malware — dubbed CLOSEDQUORUM — is the first publicly documented Windows implant to use this approach for command-and-control, or C2.

The finding lands alongside a new open source tool Talos built specifically to catch this class of threat, and it raises a question defenders are only starting to grapple with: what happens to incident response timelines when the attacker's decision loop never sleeps?

Four Models, One Vote

According to Talos, CLOSEDQUORUM can query up to four LLM providers: Google Gemini, DeepSeek, Qwen, and Mistral. Once deployed, it does not require continued commands from a human operator. Instead, it delegates its next action to a quorum of the models, which vote on what it should do.

The voting order isn't neutral. If the vote is tied, DeepSeek's vote takes precedence, followed by Qwen, Mistral, and Gemini. The models aren't asked open-ended questions about strategy — they're asked to pick from a fixed menu of executable options baked into the binary, so the AI is choosing among predetermined actions rather than improvising new ones.

Talos analyst Ryan Fetterman described the design in a blog post published Tuesday, framing it as a session with no human participants at all.

"The session is closed; no humans are admitted,"

— Ryan Fetterman, Talos analyst. He continued by describing the mechanics directly:

"Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment."

The phrase Fetterman uses for this pattern is "effort displacement" — moving a phase of the attack from a human operator to AI systems. That shift, he argues, can compound the speed and scale advantages of an intrusion by removing the human bottleneck entirely.

The Human Bottleneck Disappears

The practical argument for outsourcing decisions to models is straightforward, and Fetterman makes it explicitly in his writeup. Human operators are constrained by how long they can pay attention, how many hours they work, and how much cognitive load they can carry. An AI system executing a phase of the attack chain doesn't have those constraints.

"Human operators are bound by attention, working hours, and cognitive load,"

"An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps."

That's the core of the concern Talos is describing. Traditional intrusion timelines have natural gaps — the attacker logs off, sleeps, moves to another target. If a system can keep making decisions in those gaps, the intrusion continues without the operator present, which changes the tempo defenders have to plan around.

What the Malware Can Actually Do

The decision space the models are choosing from is limited but concrete. Talos extracted a system prompt from the binary that constrains the models to pick "ONLY executable decisions," and it opens by telling each model: "You are an advanced malware strategist." From there, the models choose among a set of capability modules.

• Steal — runs commands to dump LSASS memory for Windows credentials, harvest saved browser passwords across Google Chrome, Microsoft Edge, and Mozilla Firefox, and extract cryptocurrency wallet data including MetaMask, Exodus, and Ethereum.
• Inject — generates shellcode, then executes it using process hollowing or Early Bird injection.
• Persist — establishes persistence on the infected device.

So the quorum isn't deciding whether to attack at all; it's deciding which of three pre-built moves to make at a given moment. The models are selecting from a menu, not authoring new malware.

Credential Theft, Discord, and a Rotating Key

Once credentials are stolen, Talos says they land in the operator's Discord channel. The data is encrypted with AES-256-GCM and a daily rotating key that the operator derives from the message timestamp — meaning the key changes each day and is tied to when the message was sent, not to a static secret stored in the binary.

Talos also believes the developer provides each operator with a customized executable containing that operator's Discord webhook and LLM API keys, which are injected at compile time. That per-operator build process means the binary isn't a single shared sample floating around — it's tailored before it ever reaches a target.

Origins and a 2025 Trail

Talos says its threat hunters have not observed any in-the-wild deployment of CLOSEDQUORUM. That's an important qualifier: this is a documented capability, not a confirmed active campaign. But the researchers say artifacts from the binary link its developer to postings dating back to 2025 on criminal forums related to carding.

That linkage is based on artifacts found during analysis, not on observed attacks, and Talos describes the connection in terms of the binary itself rather than any identified victim. The distinction matters — the finding describes what the malware is built to do and who appears to have built it, not what it has already done to anyone.

How Talos Found It

CLOSEDQUORUM wasn't spotted by domain-blocking alerts or signature matching. Talos discovered the binary using its new CAIRN toolkit — short for Cognitive Artifact Intelligence Research Network — which is designed for hunting, classifying, and tracking emerging AI-integrated malware. The company made CAIRN available as an open source repository on Tuesday, the same day it published its analysis.

The existence of a dedicated toolkit for this category is itself part of the story. Talos built CAIRN to find AI-integrated malware, and the first thing it surfaced with it is a Windows implant that delegates C2 decisions to four different language models. That's a specific tool built for a specific emerging problem, and the tool found a concrete example of the problem.

For defenders, Fetterman's guidance points away from the reflex of blocking domains. The "most useful detection strategy," he wrote, is to look at behavioral characteristics instead.

"Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently,"

"Far fewer should contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence."

The logic here is about correlation. Any single one of those network contacts is unremarkable on its own — plenty of software talks to Gemini or Discord. The signal, per Talos, is an endpoint doing several of those things at once while also touching LSASS memory, injecting into suspended processes, or setting up WMI persistence. That combination is what separates the implant from normal traffic.

Why the Quorum Design Matters

Using multiple models rather than one is a deliberate architectural choice, and the voting order tells you something about how the developer thinks about reliability. If any single model provider were the only decision-maker, an outage, a rate limit, or a change in how that provider handles a request could stall the malware. A quorum with a tiebreak order — DeepSeek first, then Qwen, Mistral, and Gemini — gives the attacker redundancy across providers that have no relationship to one another.

It also spreads the footprint. Instead of one API key and one service, the binary's behavior touches four LLM providers plus Discord. To a defender running domain blocking alone, that looks like several unrelated services being contacted by the same host. To a defender watching process behavior, it looks like a host that is simultaneously reading credential stores and talking to a stack of AI endpoints it has no business talking to.

The models, for their part, are given a narrow role. They don't write code, they don't discover vulnerabilities, and they don't decide to attack. They rank and vote on which of three pre-built actions — steal, inject, or persist — comes next. The system prompt extracted from the binary tells each model it is an "advanced malware strategist," but the actual decision surface is small and fixed.

What Defenders Should Watch

The detection guidance Talos offers is behavioral and specific. The combination it flags is a host that contacts multiple LLM providers and Discord while also showing signs of credential dumping, process injection, or persistence creation. That's a correlation problem, and it requires telemetry that ties network activity to process activity on the same endpoint.

On the network side, Talos names DeepSeek, OpenRouter, Mistral, Gemini, and Discord as services the implant may contact. The researchers are explicit that contacting any one of these independently is not by itself suspicious — the point is the pattern, not the destination.

On the host side, the actions the models can choose map to well-understood techniques: LSASS memory dumping for Windows credentials, browser password theft across Chrome, Edge, and Firefox, cryptocurrency wallet extraction covering MetaMask, Exodus, and Ethereum, shellcode injection via process hollowing or Early Bird injection, and persistence establishment. None of these are novel on their own. What's new is that a language model quorum is deciding which of them happens next.

The Stakes for Incident Response

For security teams, the implication that follows from Talos's description is about response windows. If an implant can keep selecting actions without an operator present, the quiet hours that incident responders have historically relied on — the overnight gap, the weekend, the stretch when an attacker is presumably offline — stop being a reliable assumption. That doesn't mean every intrusion now runs around the clock; Talos has not observed this one deployed at all. But the capability it describes is specifically aimed at removing the pauses that human operators introduce.

For organizations, the practical takeaway is that detection logic built around destinations will struggle with an implant that deliberately spreads its traffic across four unrelated AI providers and Discord. The behavior Fetterman points to — several of those contacts plus LSASS access, injection, or WMI persistence — requires stitching together network and endpoint telemetry rather than watching either in isolation.

And for the broader picture, the fact that Talos needed a dedicated toolkit to find this category of malware suggests the search problem is only beginning. CAIRN is now open source, which means other researchers and defenders can use the same approach. The malware Talos found is one binary, tied to artifacts pointing back to 2025 carding-forum activity, with no observed deployment. But it demonstrates a design pattern — delegating decisions to a model quorum so the attack doesn't pause — that defenders will now have to account for in how they detect and how fast they respond.