Cisco Finds Windows Security Threat Using Four AI Models to Choose Attacks

Cisco Talos has disclosed CLOSEDQUORUM, a Windows malware implant that pushes AI beyond simple assistance.

The malware can use DeepSeek, Qwen, Mistral, and Google Gemini to decide what it should do next. It then follows the choice that gets the most votes without needing a fresh command from a human operator. In many cases, AI may help write code or create commands. Here, AI models sit inside the malware’s control loop.

Talos says this is the first public case it has found of a Windows implant using several commercial AI models this way.

Earlier AI-powered malware, like LAMEHUG, used an AI model to generate commands during an attack. Ukraine’s CERT-UA discovered LAMEHUG in 2025. This tool used Qwen through Hugging Face to create commands for reconnaissance and file theft.

CLOSEDQUORUM goes a step further. Its AI calls help decide which built-in attack action comes next.

Four AI Models Vote

CLOSEDQUORUM is a 16.4MB Windows program written in Go. When it starts, it checks the computer. It can gather the Windows version, CPU count, system name, and other basic details. It also checks whether it has admin rights.

The malware then sends this data to up to four AI services. Each model gets a task and returns a choice. CLOSEDQUORUM counts the answers. It then picks the action with the most votes. The main choices include steal, inject, and persist.

The code also has a move option. Talos said that option has no working action in the build it studied. The voting system also has a tie rule. DeepSeek gets the first choice, followed by Qwen, Mistral, and Gemini.

The AI models cannot simply invent any action. CLOSEDQUORUM limits their choices to actions already built into the program. Even so, the setup gives AI a direct role in deciding what the malware does next.

It can Steal Passwords and Crypto Data

CLOSEDQUORUM includes several tools for stealing data. It can target LSASS, a Windows process that can hold login secrets, and also steal saved passwords in Chrome, Edge, and Firefox.

Also, Talos found code that goes after MetaMask, Exodus, and Ethereum wallet credentials. CLOSEDQUORUM can also inject code into other running programs. Talos found code for process hollowing and Early Bird injection.

The malware has ways to stay on an infected PC after a restart. These include Windows Registry Run keys, scheduled tasks, and Windows Management Instrumentation.

For example, it can suppress some Windows ETW telemetry. ETW helps security tools track events inside Windows. The malware also waits before it starts key activity. Talos found a delay of about five minutes. Later checks can occur at random times between five and 15 minutes.

AI Services Replace Part of the Usual C2 Setup

CLOSEDQUORUM does not rely only on a server run by its creator. Instead, it uses public AI services as part of its control system. That is important because traffic to a real AI provider can look less unusual than traffic to a new attacker domain.

The malware can also utilize a Discord webhook in order to send the information gathered and hijacked.

Talos discovered that CLOSEDQUORUM encrypts the acquired information using AES-256-GCM, then encodes the information into Base64 format and sends it in parts.

Security teams can look for several signs at once. For example, a Windows program may contact several AI services while also reading LSASS or creating persistence.

A program that does those things and talks to Discord would also deserve close review. AI-driven malware is not the only spyware threat targeting specific groups. Iranian state cyber actors use CHOSEN BRICK spyware to target dissidents and Journalists examines a separate campaign involving spyware reportedly used against dissidents and journalists.

There is no Proof of a Live Campaign

The biggest caveat is simple: Talos has not confirmed that CLOSEDQUORUM has been used against real victims. The public build contains placeholder API keys. It also contains a dummy Discord webhook. As a result, Talos could not watch a full attack using the sample it studied.

The researchers did find other development files. Some show API keys and Discord details being added when the malware was built. Talos also found links between the developer and posts on criminal forums. Those posts involved carding activity dating back to 2025.

That does not prove the malware was used in an attack. Talos did not name a threat group or report confirmed victims.

Why the Design Matters

CLOSEDQUORUM shows a shift in how attackers could use AI. AI is no longer only a tool for writing code or commands. In this case, the models help choose the next step inside the malware.

CLOSEDQUORUM needs access to outside AI services. It also depends on model replies and on the actions already built into the malware. Those needs may give defenders new ways to spot it.

For now, CLOSEDQUORUM is best viewed as an early example of AI-driven malware design, not proof of a live campaign. But its design gives security teams a useful warning. Future malware could give AI a bigger role in making attack decisions.