AI-Driven Malware CLOSEDQUORUM Lets Chatbots Vote on Its Next Attack Step

Cisco Talos researchers have identified a novel Windows malware called CLOSEDQUORUM that changes how malicious software is controlled. Instead of taking orders from a command-and-control server run by an attacker, it sends details about the infected computer, such as its name, Windows version, and admin status, to up to four commercial AI services (DeepSeek, Qwen, Mistral, and Google Gemini). Each model votes on one of four possible actions: stealing credentials, injecting code, persisting on the system, or moving laterally. The malware tallies the responses and carries out whichever action wins the vote.

The attacker still monitors these AI-driven decisions and any stolen data through a Discord channel, meaning human oversight remains but active command-giving is no longer required once the malware is deployed. Talos noted the publicly discovered version is incomplete: it lacks working code for the 'move' action and uses placeholder API keys and webhook links, so it cannot currently function end to end. The researchers linked code clues to a developer previously tied to carding forum activity, and said this is the first publicly documented case of malware handing over its control decisions to AI models.

While this variant is not yet fully operational, it signals a potential shift in malware design, where AI models could increasingly be used to make real-time decisions during an attack, reducing the need for direct attacker involvement.