This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next

A Windows malware sample called CLOSEDQUORUM can choose its next move without waiting for an attacker to send instructions. Once configured and deployed, it asks AI models whether to steal data, hide in a process, or maintain access.

The decision maker no longer needs a dedicated control server. The sample emerged from research into software that uses AI during an attack.

Its delivery route is unknown; operators apparently deploy customized copies themselves, rather than relying on a single known campaign.

There is no confirmed deployment in the wild, so reported capabilities should not be mistaken for verified victim impact. Analysts from Cisco Talos identified the implant through their CAIRN research project.

Cisco Talos said in a report shared with Cyber Security News (CSN) that the publicly available build contains placeholder access keys and a dummy reporting address. Researchers examined its decision loop but did not see it work end to end.

That distinction matters because CLOSEDQUORUM is a warning about a workable design, not evidence of a widespread campaign.

It aims to take Windows and browser passwords and cryptocurrency wallets. Readers following research into AI malware will recognize the broader shift: attackers are testing ways to leave routine tactical choices to software.

This Malware Doesn’t Wait for Hackers

CLOSEDQUORUM sends details about the infected computer to as many as four AI models: DeepSeek, Qwen, Mistral, and Gemini.

The details include its operating system, processor count, and administrator rights. The models receive a limited menu of actions rather than an open invitation to invent attacks.

Each available model responds with a structured choice, and the malware counts the votes. The most popular choice wins; a tie favors the earliest responding provider in a fixed order, starting with DeepSeek.

If no usable response arrives, the program pauses and tries again rather than acting on its own. This is automation within boundaries set by its author, not independent reasoning without limits.

A vote to steal would trigger searches for Windows login secrets, saved browser passwords, and wallet data. Other choices can plant code inside another running process or establish a way to start again later.

One listed action, moving across a network, has no working handler in the distributed build. That limits its ability to conduct a complete intrusion. The operator would still choose where to place a customized copy and supply the keys needed to reach the models.

In the proposed setup, the software reports decisions and sends stolen material through a Discord webhook. Its date-derived encryption key could also be known to the developer, limiting privacy for operators.

What Defenders Can Watch For

Traditional malware often calls home to an attacker-controlled server. CLOSEDQUORUM instead relies on ordinary AI services for tactical decisions, making any single provider address a poor basis for detection.

This differs from the autonomous AI agents behind credential theft reported elsewhere, where agents helped run an attack against cloud systems rather than serving as a Windows implant’s voting panel.

The stronger signal is a sequence of behaviors. Security teams can look for an unexpected Windows program contacting several AI providers close together, then accessing Windows credential memory, injecting into another process, creating persistence, or communicating with a Discord webhook.

Talos also describes an initial delay followed by repeated activity at irregular intervals of five to fifteen minutes. This avoids treating legitimate AI requests as hostile.

It also recognizes that a Discord message alone is not proof of infection; other stealers have used similar channels, as earlier Discord webhook malware coverage shows.

Correlating process behavior, network activity, and changes that keep software running gives investigators a clearer picture than blocking a popular service outright.

Researchers linked development artifacts to a person active on carding forums, but that connection does not establish an active campaign or identify victims.

Model refusals, rate limits, and badly formatted replies can also interrupt the decision loop. The larger concern is that future variants could improve those weaknesses and keep choosing their next move while their operator is offline.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post This Malware Doesn’t Wait for Hackers—It Asks AI Models What to Do Next appeared first on Cyber Security News.