Exodus (Product): news timeline & CVEs

CLOSEDQUORUM, the malware that asks four AI models what to do next

Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.

Cisco Talos documented CLOSEDQUORUM, a Windows implant that sends host context to DeepSeek, Qwen, Mistral, and Google Gemini and executes the majority vote among steal, inject, persist, or move. The steal path dumps LSASS credentials, saved passwords from Chrome, Edge, and Firefox, and wallets such as MetaMask and Exodus, then exfiltrates AES-256-GCM data through a Discord webhook. The public sample is inert with placeholder API keys, while development builds embed real credentials. Talos found it with the CAIRN toolkit and linked artifacts to carding-forum posts from 2025.

Security AffairsSep 24, 05:44 UTC · 3d agoMalware 13 sources

This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.

Cisco Talos describes CLOSEDQUORUM, Windows malware that asks up to four AI models—DeepSeek, Qwen, Mistral, and Gemini—to vote on steal, inject, persist, or move, then runs the majority choice. Steal dumps LSASS, copies Chrome, Edge, and Firefox passwords, and collects MetaMask, Exodus, and Ethereum wallet data, sending results through a Discord webhook. Talos has not seen the full chain work, and public builds contain placeholder API keys. The code dates to at least June 17, 2026; Talos published Snort rule 1:66984, YARA logic, six SHA-256 hashes, and the CAIRN hunting tool.

The Hacker Newsupdated Sep 24, 05:44 UTC · 3d agofirst Sep 23, 14:17 UTC · 3d agoMalware 13 sources

Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control

Researchers find CLOSEDQUORUM, a Windows malware that uses commercial LLMs as an autonomous decision engine for post-compromise actions like credential theft.

Cisco Talos researchers identified CLOSEDQUORUM, a Windows malware implant that uses commercial large language models as an autonomous command-and-control layer. The malware gathers host context, queries a panel of LLM providers (DeepSeek, Qwen, Mistral, Gemini), and executes prebuilt malicious capabilities like credential theft and process injection based on model votes. While not yet observed in active attacks, the sample is linked to criminal-forum activity from 2025, demonstrating a shift from human-driven to AI-driven attack phases.

GBHackersupdated Sep 24, 05:44 UTC · 3d agofirst Sep 23, 05:52 UTC · 4d agoMalware 13 sources

New ClosedQuorum Windows malware uses AI for attack decisions

ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.

Cisco Talos analyzed ClosedQuorum, a Go Windows implant that asks Gemini, DeepSeek, Qwen, and Mistral to vote on steal, inject, persist, or move, with DeepSeek breaking ties. Steal simultaneously dumps LSASS, Chrome, Edge, and Firefox credentials, and MetaMask, Exodus, and Ethereum wallets, then sends results to a Discord webhook. Injection generates shellcode for process hollowing or Early Bird APC injection; the studied build has no lateral-movement handler. Talos reports no confirmed in-the-wild use, only placeholder API keys and a dummy webhook, and linked artifacts to 2025 carding-forum posts.

BleepingComputerupdated Sep 24, 05:44 UTC · 3d agofirst Sep 22, 18:04 UTC · 4d agoMalware 13 sources

Exodus

Timeline4 articles

Appears with

CLOSEDQUORUM, the malware that asks four AI models what to do next

This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

Researchers Find Malware That Uses AI Models Instead of Human Hackers for Control

New ClosedQuorum Windows malware uses AI for attack decisions