A new strain of Windows malware no longer waits for a hacker to tell it what to do. Researchers at Cisco Talos have found the ClosedQuorum malware, which lets four AI models vote on its next move. The panel of Gemini, DeepSeek, Qwen, and Mistral then decides if the malware steals data, digs in, or injects code. For anyone who saves passwords in a browser or keeps crypto in a desktop wallet, this story is worth a close look.
What Is the ClosedQuorum Malware?
The ClosedQuorum malware is a Windows program written in the Go programming language. Once it lands on a machine, it gathers details about the system and sends them to its AI panel. The models then pick an action from a short, fixed list, and the malware acts with no human input.
In a traditional attack, a human operator sends orders to infected machines from a command-and-control (C2) server. That person decides when to steal files, when to spread, and when to stay quiet. ClosedQuorum replaces the operator with software, so the attack can run at any hour. Cisco Talos calls it the first publicly documented Windows implant to hand these C2 decisions to a panel of AI models.
How the AI Voting System Works
Instead of trusting a single chatbot, the ClosedQuorum malware treats its four models like a small committee. Each model reviews the data from the infected computer and casts a vote for one of the allowed actions. When the vote ends in a tie, DeepSeek gets the final say, followed by Qwen, Mistral, and then Gemini.
The Four Possible Actions
The ClosedQuorum malware limits its AI panel to a set of fixed choices, so the models cannot invent new tactics. Its first option, called “steal,” launches several data grabs at the same time. It dumps login credentials from LSASS, a core Windows process, and pulls saved passwords from Chrome, Edge, and Firefox. On top of that, it goes after crypto wallets, including MetaMask, Exodus, and Ethereum wallets.
The “inject” option creates shellcode, which is a small chunk of attack code, and slips it into a real, trusted process. To do this, it uses either process hollowing or a method known as Early Bird APC injection. Both tricks help harmful code hide inside programs that look harmless.
The “persist” choice runs a module that helps the malware survive on the system over time. A fourth option, “move,” would let the malware spread to other machines on the same network. However, the build that researchers studied has no code to handle that command, so it cannot spread this way yet.
Stolen Data Goes Straight to Discord
After the ClosedQuorum malware collects its loot, it sends everything to the operators through a Discord webhook. A webhook is a simple link that lets a program post messages into a Discord channel on its own. Because of this setup, the attackers only need to deliver the malware. The rest of the attack can run on its own.
Why AI-Powered Malware Raises the Stakes
Cisco Talos says this design gives attackers more speed and makes it easier to scale their attacks. A human operator needs sleep, but an automated system has no such limits. The researchers also warn that the ClosedQuorum malware marks an “architectural shift towards attack-chain automation.” In plain terms, AI-powered malware could let small criminal groups run campaigns that once needed a full team.
Where the ClosedQuorum Malware Falls Short
This approach has clear weak spots, and Cisco points several of them out. The malware relies on commercial AI services, so rate limits or an offline API can stall it. It can also break if a model returns malformed output that the code cannot read.
Researchers also call the ClosedQuorum malware unsophisticated. They cannot yet say if it is a test or an early experiment. The sample they studied contains placeholder API keys and a dummy Discord webhook. Still, anyone building a custom version could add working credentials and turn it into a live threat.
So far, Cisco Talos has found no proof of real-world attacks. “While we do not have confirmation of in-the-wild deployment, artifacts from the binary were used to connect the developer to postings on criminal forums related to carding, dating back to 2025,” the researchers explain. Carding refers to the buying, selling, and abuse of stolen payment card data.
How Researchers Spotted It
Talos found the ClosedQuorum malware with CAIRN, an open-source toolkit it released to track and study AI-integrated malware. Because the toolkit is free, other security teams can use it to hunt for similar threats. Tools like this will matter more as attackers keep testing AI inside their code.
How to Protect Yourself from AI-Driven Threats
The good news is that the ClosedQuorum malware still has to reach your computer before it can do anything. So the basic rules of safe computing still apply: avoid unknown downloads, keep Windows updated, and run trusted antivirus software. Also, think twice before saving passwords in your browser, since the ClosedQuorum malware targets them directly.
Crypto holders should consider moving larger balances from desktop wallets to a hardware wallet. A password manager with strong, unique passwords and two-factor authentication also limits the damage from any stolen login. These steps will not stop every attack, but they make stolen data far less useful to criminals.
A VPN adds another layer of protection on public Wi-Fi, because it encrypts your traffic and hides your IP address. Some providers, such as NordVPN and Surfshark, also include tools that block known harmful websites before they load. However, a VPN cannot remove malware already running on your device, so pair it with antivirus software and good habits.
Final Thoughts
The ClosedQuorum malware is crude, unproven in real attacks, and reliant on services that can fail at any time. Even so, it offers an early look at a future where AI models make the choices human hackers once made. Everyday users should not wait for a more polished version before they tighten their habits. Strong passwords, careful downloads, and layered protection remain the best answer to AI-powered malware.
