Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions

A new piece of malware called CLOSEDQUORUM has emerged, targeting Windows systems. This malware has the ability to query up to four large language model (LLM) providers, including Google Gemini, DeepSeek, Qwen, and Mistral, in order to autonomously choose from a set of post-compromise actions. These actions can include stealing users' credentials, cryptocurrency wallets, and other sensitive information.

According to Cisco Talos, a security company, this is the first known Windows-based malware to use this approach for command-and-control (C2) operations. Talos discovered the malware using its CAIRN toolkit, which allows for the hunting, classification, and tracking of emerging AI-integrated malware. While there have been no reported instances of CLOSEDQUORUM in the wild, Talos found that the malware's developer has links to criminal forums dating back to 2025.

After deployment, the malware delegates its next actions to a quorum of the LLMs, which vote on what should happen next. In the event of a tie, DeepSeek's vote takes precedence, followed by Qwen, Mistral, and Gemini. The Go-based malware appears to be designed to operate without human intervention, as its decisions are limited to predefined actions and the models must choose only executable decisions.

Talos believes that the malware's developer provides each operator with a customized executable containing Discord webhook and LLM API keys, which are injected at compile time. The malware's behavior is similar to that of other legitimate applications, making it difficult to detect through domain blocking alone. Instead, analysts should focus on behavioral characteristics, such as monitoring for contact with multiple LLMs while also accessing sensitive system resources like LSASS or injecting into suspended processes.