Cisco Talos has documented a Windows implant that hands its tactical decisions to a panel of commercial AI models instead of a human operator.
Named CLOSEDQUORUM, the malware polls four large language models during an intrusion: DeepSeek, Qwen, Mistral and Google Gemini. Each must answer with one of four actions, steal, inject, persist or move. The implant tallies the replies and runs whichever wins. Ties break in a fixed order, with DeepSeek holding the deciding vote because it loads first in the code.
Talos has a label for this: effort displacement. Speed and scale still leave a person choosing targets. Here the person is simply gone from one stage of the job, which means a break-in can carry on after the attacker logs off.
Pick steal and three jobs fire at once. Credentials get drained from LSASS memory. Saved passwords get lifted from Chrome, Edge and Firefox. The host is swept for crypto wallets, MetaMask and Exodus among them. Persist sets up the usual reboot-survival tricks, while a fourth option, move, sits in the code with nothing behind it.
Exfiltration sidesteps traditional command-and-control. Stolen material is AES-256-GCM encrypted and shipped to a Discord webhook, traffic that can blend into ordinary application behaviour. The key is derived from the current date, so the developer could decrypt any operator’s haul just by knowing the day.
Talos found the sample through CAIRN, a new open-source toolkit for AI-driven threats. The public binary is inert, carrying placeholder API keys, but development builds ship with live credentials, suggesting the author sells custom builds. Defenders are urged to watch for Windows processes contacting several AI providers and Discord while also touching LSASS.
