ClosedQuorum Windows Malware Uses AI Models to Choose Attack Actions

Researchers have identified ClosedQuorum malware, a Windows implant that asks four AI models to choose its next action after compromising a device. Cisco Talos says the software can make those decisions without instructions from a human operator.

However, researchers have not confirmed that attackers have deployed ClosedQuorum in the wild. The sample they analyzed also contained placeholder credentials and a dummy destination for stolen data.

Four AI Models Vote on the Next Step

ClosedQuorum is written in Go. After gathering information from an infected host, it sends that context to Google Gemini, DeepSeek, Qwen and Mistral. The models then vote on what the malware should do next.

The program limits their choices to actions its developers defined in advance. If the vote ends in a tie, ClosedQuorum gives DeepSeek priority. Qwen, Mistral and Gemini follow in that order.

According to Cisco Talos, this design lets the malware select an action without waiting for a human operator. Still, the models cannot give it capabilities that the underlying program lacks.

Available Actions Include Theft and Persistence

One possible decision tells ClosedQuorum to steal information. That action attempts to collect Windows credentials, saved browser credentials and cryptocurrency wallet data.

Another option triggers code injection into a Windows process. The malware can also choose to run its persistence module, which aims to keep it active on the device.

The menu includes lateral movement as a possible decision. However, the analyzed build has no handler for that option. As a result, this version cannot carry out lateral movement even if the models select it.

ClosedQuorum is designed to send stolen information to its operators through a Discord webhook. The sample Cisco Talos examined used a dummy webhook, so its presence alone does not show that this build transmitted data.

Researchers Have Not Confirmed Live Attacks

Cisco Talos describes ClosedQuorum as the first publicly documented Windows implant that delegates tactical command decisions to a panel of AI models. The researchers found it through CAIRN, their toolkit for studying malware that incorporates AI.

The malware’s purpose remains unclear. Cisco Talos says it could be a test or experiment, and it has no confirmation of deployment in real attacks. Researchers did, however, connect artifacts from the binary to a developer’s posts on criminal forums.

The design also has practical weaknesses. API rate limits, malformed model responses or unavailable services could interrupt its decision process. Even with those limits, ClosedQuorum shows how malware developers are exploring ways to automate steps after an initial compromise.