Malware Employs AI Panel to Decide Next Move

Cisco Talos's discovery of CLOSEDQUORUM, a Windows implant, has shed light on a new malware tactic. Instead of relying on a hacker-controlled server, this malware uses a panel of four commercial AI models to determine its next move.

The malware, which is written in Go and compiles to a single static binary, reaches out to the AI chat APIs and describes its situation before asking for advice from the panel. The votes are tallied, and the action with the most votes wins.

ClosedQuorum's AI panel consists of DeepSeek, Qwen, Mistral, and Google Gemini, which are all commercial large language models with public, pay-as-you-go APIs. This design choice allows the malware to inherit the uptime, latency, and content-filtering behavior of these vendors, making it harder for defenders to detect.

The theft target list includes Windows credentials, saved browser passwords, and cryptocurrency-wallet data. Unlike traditional infostealer malware, ClosedQuorum's AI panel can weigh context each time it queries the models, choosing when and how to go after each target.