This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next

A Windows malware sample called CLOSEDQUORUM can choose its next move without waiting for an attacker to send instructions. Once configured and deployed, it asks AI models whether to steal data, hide in a process, or maintain access.

The decision maker no longer needs a dedicated control server. The sample emerged from research into software that uses AI during an attack.

Its delivery route is unknown; operators apparently deploy customized copies themselves, rather than relying on a single known campaign.

There is no confirmed deployment in the wild, so reported capabilities should not be mistaken for verified victim impact. Analysts from Cisco Talos identified the implant through their CAIRN research project.

Cisco Talos said in a report shared with Cyber Security News (CSN) that the publicly available build contains placeholder access keys and a dummy reporting address. Researchers examined its decision loop but did not see it work end to end.

That distinction matters because CLOSEDQUORUM is a warning about a workable design, not evidence of a widespread campaign.

It aims to take Windows and browser passwords and cryptocurrency wallets. Readers following research into AI malware will recognize the broader shift: attackers are testing ways to leave routine tactical choices to software.

This Malware Doesn’t Wait for Hackers

CLOSEDQUORUM sends details about the infected computer to as many as four AI models: DeepSeek, Qwen, Mistral, and Gemini.

The details include its operating system, processor count, and administrator rights. The models receive a limited menu of actions rather than an open invitation to invent attacks.

Each available model responds with a structured choice, and the malware counts the votes. The most popular choice wins; a tie favors the earliest responding provider in a fixed order, starting with DeepSeek.

If no usable response arrives, the program pauses and tries again rather than acting on its own. This is automation within boundaries set by its author, not independent reasoning without limits.

A vote to steal would trigger searches for Windows login secrets, saved browser passwords, and wallet data. Other choices can plant code inside another running process or establish a way to start again later.

One listed action, moving across a network, has no working handler in the distributed build. That limits its ability to conduct a complete intrusion. The operator would still choose where to place a customized copy and supply the keys needed to reach the models.

In the proposed setup, the software reports decisions and sends stolen material through a Discord webhook. Its date-derived encryption key could also be known to the developer, limiting privacy for operators.

What Defenders Can Watch For

Traditional malware often calls home to an attacker-controlled server. CLOSEDQUORUM instead relies on ordinary AI services for tactical decisions, making any single provider address a poor basis for detection.

This differs from the autonomous AI agents behind credential theft reported elsewhere, where agents helped run an attack against cloud systems rather than serving as a Windows implant’s voting panel.

The stronger signal is a sequence of behaviors. Security teams can look for an unexpected Windows program contacting several AI providers close together, then accessing Windows credential memory, injecting into another process, creating persistence, or communicating with a Discord webhook.

Talos also describes an initial delay followed by repeated activity at irregular intervals of five to fifteen minutes. This avoids treating legitimate AI requests as hostile.

It also recognizes that a Discord message alone is not proof of infection; other stealers have used similar channels, as earlier Discord webhook malware coverage shows.

Correlating process behavior, network activity, and changes that keep software running gives investigators a clearer picture than blocking a popular service outright.

Researchers linked development artifacts to a person active on carding forums, but that connection does not establish an active campaign or identify victims.

Model refusals, rate limits, and badly formatted replies can also interrupt the decision loop. The larger concern is that future variants could improve those weaknesses and keep choosing their next move while their operator is offline.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7	Sample in the developer’s seven-day build chain.
SHA-256	c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7	Sample in the developer’s build chain.
SHA-256	c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86f	Sample in the developer’s build chain.
SHA-256	f5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c	Sample in the developer’s build chain.
SHA-256	5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cb	Sample in the developer’s build chain.
SHA-256	eddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5	Sample in the developer’s build chain.
Domain	api.deepseek.com	AI-provider domain in the detection rule; legitimate service, not malicious on its own.
Domain	openrouter.ai	AI-routing domain in the detection rule; legitimate service, not malicious on its own.
Domain	api.mistral.ai	AI-provider domain in the detection rule; legitimate service, not malicious on its own.
Domain	cdn.discordapp.com	Discord domain used as a detection-rule anchor; legitimate service, not malicious on its own.
File name	gohno-final.exe	Developer build named in the detection-rule comments.
File name	earlyburb.exe	Build named in the detection-rule comments.
File path	C:\Windows\Temp\wmi.ps1	Script path consistent with the implant’s WMI persistence mechanism.
Directory	C:\Windows\Temp\	Staging location described for collected files before transmission.
File name	logins.json	Firefox credential file the implant seeks to collect.
File name	Login Data	Chrome and Edge credential database the implant seeks to collect.
File name	exodus.wallet	Exodus wallet file referenced among collection targets.
Registry value	WindowsUpdate	Value created under the current user’s Registry Run key for persistence.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC