This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next
Cisco Talos documents CLOSEDQUORUM, a Windows implant that votes across DeepSeek, Qwen, Mistral, and Gemini APIs to choose attack actions autonomously.
58
Organization
CLOSEDQUORUM
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 22, 2026
- Last mentionedSep 23, 2026
Timeline
3 articles · newest firstAI malware just removed the human from the attack loop
Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.
62
Windows CLOSEDQUORUM malware uses AI models to autonomously select post-compromise actions
Cisco Talos documents CLOSEDQUORUM, the first known Windows implant using a four-LLM quorum to autonomously choose credential theft, wallet theft, injection, and persistence actions.
60
Appears with
- DeepSeekorganization · 3
- Qwenai model · 3
- Mistralai model · 3
- Cisco Talosorganization · 3
- Google Geminiorganization · 2
- CAIRNorganization · 1
- Geminiai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.