MalwareTips News CLOSEDQUORUM malware lets AI models choose its next move

[News Now]

Image: Cisco Talos

Cisco Talos has analyzed a Windows implant that asks commercial AI models to choose actions such as stealing credentials, gaining persistence or injecting code into another process. There is no confirmed real-world deployment, and the publicly observed build cannot operate because it contains placeholder credentials.

Good to know

This is an early malware sample, not evidence that autonomous AI-controlled attacks are already widespread.

Passwords and wallets are the intended targets​

If configured and delivered to a Windows PC, CLOSEDQUORUM is designed to extract Windows account credentials, saved passwords from Chrome, Edge and Firefox, and data belonging to MetaMask, Exodus and Ethereum wallets.

The implant can also establish persistence so that it runs again, and it can hide malicious code inside another process. Collected data is encrypted and sent to an operator-controlled Discord webhook.

• Keep Windows, browsers and security software updated, and do not run unexpected executable files received through downloads, chat or email.
• If security software flags CLOSEDQUORUM, isolate the PC and change browser-saved passwords from a separate, trusted device.
• Crypto-wallet users should move funds only if there is evidence the wallet files or recovery material were exposed.

Four AI services vote on each action​

CLOSEDQUORUM can query DeepSeek, Qwen, Mistral and Google Gemini in sequence. Their responses are counted, and the action with the most votes is selected without requiring fresh commands from a human-operated command-and-control server.

The models do not receive unlimited control. They must return structured data choosing from capabilities already built into the malware, and invalid or unsupported responses are discarded.

Why behavior matters more than blocking AI sites​

Blocking AI-provider or Discord domains alone would create false alarms because legitimate programs use those services. Talos says the stronger signal is a combination of unusual AI API traffic with behavior such as accessing LSASS, injecting into processes, creating persistence and contacting Discord.

For home users, a reputable security product and caution around unknown executables remain the practical defenses. Organizations can additionally investigate unexpected Windows programs contacting several AI providers at short intervals.

Important

Do not assume every connection to Gemini, Mistral, DeepSeek, Qwen or Discord is malicious; the surrounding process behavior is what makes this activity suspicious.