Cybersecurity
CLOSEDQUORUM lets AI models choose malware actions
Cisco Talos said the Windows malware CLOSEDQUORUM queried up to four commercial AI services to decide what to do next, though the sample it analysed did not fully function.
- Cisco Talos said it found CLOSEDQUORUM with CAIRN, an open-source tool it released the same day.
- Talos said CLOSEDQUORUM sent host details and a fixed action list to DeepSeek, Qwen, Mistral and Google Gemini, then used the usable replies to pick an action.
- Talos said the public build used placeholder API keys and webhook values, so it could not contact the services or send data, and Talos had not seen the scheme work end to end.
- Talos said, to its knowledge, CLOSEDQUORUM was the first publicly documented Windows implant to delegate command-and-control decisions to AI models.
- Talos said the sample could dump LSASS, copy saved passwords and wallet data, inject code and set up persistence through Windows mechanisms.
Cisco Talos said it found CLOSEDQUORUM with CAIRN, an open-source tool it released on the same day. The malware did not use a normal command server. Instead, it asked DeepSeek, Qwen, Mistral and Google Gemini to choose between four actions after sending them basic host details and a fixed menu.
Talos said each model had to answer in a set format, and the malware carried out the option with the most usable replies. If none answered properly, it waited and tried again. In the public sample, the move option had no code behind it.
Talos said the program posted each decision and its reason to a Discord channel through a webhook, and it sent stolen data there as well. It also said the public build used placeholder API keys and webhook values, so it could not actually contact the services or exfiltrate data.
According to Talos, the sample could dump LSASS memory, copy saved passwords from Chrome, Edge and Firefox, and collect data from MetaMask, Exodus and Ethereum wallets. It could inject code with Early Bird APC injection or process hollowing, and it could persist through a Run key, a scheduled task and a WMI subscription. Talos said clues in the code linked the developer to criminal forum posts about carding from 2025, and that the code analysis was dated 17 June 2026.
Named in this story
Organisations
- Cisco Talos
- security research team that analysed and reported the malware
Governments and agencies
- CERT-UA
- Ukrainian agency that reported LAMEHUG
Products and systems
- CLOSEDQUORUM
- Windows malware that asked AI services to choose its next action
- CAIRN
- open-source tool Talos used to find malware that used AI services
- DeepSeek
- one of the AI services the malware queried
- Qwen
- one of the AI services the malware queried
- Mistral
- one of the AI services the malware queried
- Google Gemini
- one of the AI services the malware queried
- Discord
- messaging service the malware used for decision logs and stolen data
- LSASS
- Windows process whose memory the malware dumped
- Chrome
- browser whose saved passwords the malware copied
- Edge
- browser whose saved passwords the malware copied
- Firefox
- browser whose saved passwords the malware copied
- MetaMask
- crypto wallet data the malware targeted
- Exodus
- crypto wallet data the malware targeted
- Ethereum
- crypto wallet data the malware targeted
- LAMEHUG
- earlier malware that asked an AI model to write commands
- Windows
- operating system the malware targeted
How the source tells it
The article was mostly a straight technical report, with a mild novelty frame around Talos's claim of a first public example.
- novelty first-instance framing around a claimed public first