Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control

A Windows malware implant named CLOSEDQUORUM that uses commercial large language models as an autonomous command-and-control layer, shifting tactical decisions from a human operator to an AI-driven voting system.

The sample has not been confirmed in active attacks, but Talos linked development artifacts to criminal-forum activity associated with carding discussions dating to 2025.

The discovery is significant because it moves beyond AI-assisted phishing, code generation, or operator copilots.

Instead, it gathers host context, queries a panel of LLM providers, selects the most-supported response, and executes a prebuilt malicious capability.

Cisco Talos describes this transition as “effort displacement”: transferring an entire attack phase from a human operator to an automated system rather than merely making the operator faster.

CLOSEDQUORUM is a 16.4 MB, 64-bit Windows executable written in Go with C components, enabling it to make direct Windows system calls.

Its distinctive design replaces conventional attacker-controlled C2 infrastructure with public AI-provider APIs.

Traditional implants contact a unique malicious domain, IP address, or server that defenders can identify, sinkhole, or block.

In contrast, this malware can communicate with services from DeepSeek, Qwen, Mistral, and Google Gemini platforms also used by legitimate applications.

The implant’s internal component, dubbed ModelOrchestrator, sends structured prompts to available providers sequentially.

Each model is required to return a machine-readable JSON decision rather than free-form text.

Cisco Talos Researchers said that, CLOSEDQUORUM is designed to continue an intrusion after deployment without requiring an attacker to issue each successive command.

Malware Driven by AI Models

The malware counts the votes and executes the action with the highest support. In a tie, the design deterministically favors DeepSeek, followed by Qwen, Mistral, and Gemini.

That predictable behavior could create an intelligence and detection opportunity for defenders.

The models do not receive unlimited authority. CLOSEDQUORUM constrains their output to a defined attack-decision schema and maps valid choices to embedded functions.

A “steal” decision triggers credential theft routines, including LSASS memory dumping, browser-password collection from Chrome, Edge, and Firefox, and cryptocurrency-wallet extraction targeting MetaMask, Exodus, and Ethereum wallet data.

An “inject” action can generate shellcode and use process hollowing or Early Bird APC injection.

A persistence option invokes a persistence-creation routine, while a “move” capability appears to be unfinished in the observed distribution build.

Before requesting a decision, the malware collects host information including hostname, Windows version, architecture, CPU count, administrative privilege status, and the currently relevant target process.

It inserts that context into the LLM prompt, allowing the model panel to select from the malware’s existing actions.

The chosen action, model reasoning, execution parameters, and timing information are then forwarded to an attacker-controlled Discord webhook.

Talos found that stolen data is encrypted using AES-256-GCM and transmitted to Discord as Base64-encoded content.

However, the observed publicly distributed binary was effectively an inert template: it contained placeholder API credentials and a dummy Discord webhook.

Development artifacts indicate that the author may create customized builds for individual operators, injecting each buyer’s LLM API keys and Discord endpoint at compile time.

This could support a credentials-as-a-service model in which customers handle delivery while the implant autonomously performs post-compromise decision-making.

For defenders, the key lesson is that domain blocking alone will be insufficient against LLM-backed malware.

Security teams should hunt for correlated behaviors: an unusual Windows process contacting multiple AI providers in a short period, structured prompts containing host data, LSASS access, process injection, WMI-based persistence, Discord webhook traffic, and repeated activity at randomized intervals.

Legitimate software may access Gemini, Mistral, or Discord; it should not typically do so alongside credential dumping and injection behavior.

Talos released its open-source Cognitive Artifact Intelligence Research Network, or CAIRN, alongside the research.

The toolkit identifies AI-integrated malware through metadata such as embedded prompts, provider endpoints, API-key patterns, tool-call syntax, and AI-analysis-evasion strings, without requiring analysts to execute or download a binary.

CLOSEDQUORUM is not evidence that autonomous malware is already widespread.

Rather, it is a clear proof that attackers can encode a bounded decision loop, use ordinary commercial AI APIs for reasoning, and remove the human operator from a defined portion of an intrusion.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC