Cisco Talos threat researchers have unearthed what they say is credential-stealing malware for Microsoft Windows that hands tactical decisions to a group of commercial artificial intelligence (AI) models, rather than a human operator.
Talos said CLOSEDQUORUM was, to its knowledge, the first publicly documented Windows implant to use large language models for automated command and control (C2), the channel attackers normally use to send instructions to compromised machines.
Once installed, the malware describes the infected host to up to four models, asks each what to do next, and acts on whichever answer gets the most votes from the AIs.
For criminals, the attraction is that there is no attacker-run server for defenders to trace and block.
Instead, the implant contacts the same DeepSeek, AliBaba’s Qwen, Mistral and Google Gemini endpoints that thousands of legitimate applications use every day.
Although Talos billed CLOSEDQUORUM as “autonomous”, the models, each prompted to act as a malware strategist, can only reply with one of four actions: steal, inject, persist or move.
Steal directs the malware to extract Windows credentials from memory, and to copy saved passwords from the Chrome, Edge and Firefox browsers; it will also grab cryptocurrency wallet data including from MetaMask and Exodus, Talos found.
CLOSEDQUORUM can also inject code into running processes, and establish persistence through the Windows Registry system settings database, scheduled tasks and Windows Management Instrumentation (WMI) event subscriptions.
However, the move option for the malware had no code in the build Talos looked at.
The malware has code in it that lets the first model among those it queried and responded be the tie-breaker; in the current build, that AI is DeepSeek.
Talos noted that the publicly distributed CLOSEDQUORUM binary was an inert template.
It has placeholder application programming interface (API) keys, and a dummy webhook for the Discord communications app which is the endpoint for the exfiltrated data along with the malware’s selected decisions, for an operator to review.
This meant that Talos never saw the full decision loop from start to finish, and the threat intelligence researchers have no confirmation CLOSEDQUORUM has been used against actual victims.
“CLOSEDQUORUM is best understood not as a sophisticated piece of malware, but as a demonstration that the architectural shift towards attack-chain automation is coming,” Talos said.
Growing number of AI-assisted malware
Talos theorised that the CLOSEDQUORUM developer sells customised copies of the malware, compiling a buyer’s own AI API keys into it, along with the Discord webhook.
The malware isn’t without precedents, however.
In September 2025, researchers at the NYU Tandon School of Engineering uploaded for testing a proof of concept on Google’s Virus Total malware scanning site, without marking it as academic.
Named PromptLock, the malware was arguably more autonomous than CLOSEDQUORUM, using a small locally hosted OpenAI model reachable via an API to write malicious Lua scripts to handle ransomware attacks.
Google’s Threat Intelligence Group (GTIG) also described the LameHug and PromptFlux malware in 2025 as examples of threat actors using AI tooling, and last November, Microsoft security incdent responders detailed the SesameOp backdoor that it said used OpenAI Assistants API for command and control (C2) functionality.
