CISCO Talos has identified CLOSEDQUORUM, a Windows malware sample that uses four commercial artificial-intelligence models—DeepSeek, Qwen, Mistral and Google Gemini—to choose its next action without continuous instructions from a human operator or a dedicated attacker-controlled command-and-control server. The malware collects basic host details, sends them in prompts to each model and accepts one of four decisions: steal, inject, persist or move.
It then follows the majority choice; ties are resolved in a fixed order favouring DeepSeek, then Qwen, Mistral and Gemini. Talos says the intended targets include user credentials and cryptocurrency wallets.
The steal function can dump credentials from LSASS memory, extract saved passwords from Chrome, Edge and Firefox, and search for wallets including MetaMask and Exodus. Inject handles shellcode, persist establishes reboot-survival mechanisms, while move is present in the code but currently does nothing. Stolen data is encrypted with AES-256-GCM and sent as base64 through a Discord webhook.
Talos observed repeated execution at randomised five-to-15-minute intervals, alongside activity such as AI-provider API connections, process injection, LSASS access and persistence creation. The public sample contains placeholder API keys and a dummy webhook, so it is inert, although development builds reportedly included real credentials, suggesting customised versions may have been prepared for operators.
Talos recommends investigating Windows binaries that contact several AI providers and Discord while also accessing LSASS or creating suspended processes; the technical report includes a YARA rule and MITRE ATT&CK mapping.