Cisco Talos Details Windows Malware That Lets Four LLMs Vote on Its Next Move
Cisco Talos released an open-source toolkit for hunting AI-enabled malware and detailed CLOSEDQUORUM, a Windows credential stealer with no command-and-control server that puts each tactical decision to a majority vote of four commercial language models.
The sample, which Talos calls CLOSEDQUORUM, takes its orders from no command-and-control server. Its four voters are Google Gemini, DeepSeek, Qwen and Mistral, queried in sequence every five to 15 minutes, the researchers wrote in a blog post. No other Windows malware has been publicly documented handing such decisions to a model panel.
The 16.4-megabyte Go binary hands each model the state of the host under a system prompt describing it as "an advanced malware strategist" and instructing it to return only executable decisions. The decision drawing the most votes wins, with DeepSeek holding the tie-break. The winning call is routed to one of four modules that steal credentials, inject code, establish persistence or move laterally.
"The session is closed; no humans are admitted," Talos researcher Ryan Fetterman wrote. "Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment."
The steal module runs three collection routines at once, pulling Windows credentials from process memory, saved passwords from Chrome, Edge and Firefox, and wallet files from MetaMask, Exodus and Ethereum keystores. The haul is encrypted and pushed out through Discord webhooks. Persistence is established through registry run keys, scheduled tasks and Windows Management Instrumentation subscriptions, and Windows event tracing is suppressed.
Nothing yet suggests CLOSEDQUORUM has been used against anyone, according to SiliconANGLE's report on the Talos findings. Talos holds six samples covering about a week of the developer's build chain, and artifacts inside them tie that developer to criminal forum accounts posting about carding since 2025. Talos assesses the operation as credentials-as-a-service, with the developer building customized binaries and the buyer handling delivery.
Talos placed the toolkit that surfaced the sample, the Cognitive Artifact Intelligence Research Network, or CAIRN, on GitHub. CAIRN works from metadata, so nothing has to be downloaded or detonated. Twenty-four acquisition filters look for the traces AI integration leaves behind, among them calls to commercial model providers, Python framework imports, local model runtimes and natural-language text planted to derail an automated analyst. YARA rules sort the hits into three tiers, from the bare presence of AI components up to named malware families, and an embedding model groups samples that share no strings at all.
Those filters have been running over samples collected since July 2025. When the hunts began, language models were an optional feature bolted onto a payload. A single calendar year later, the models were running the payload, with CLOSEDQUORUM at the far end of that arc.
The same evasion trick travels, Talos found. The researchers traced it back to a red team instructor, and samples from independent actors were carrying it within 12 months, crossing from loose scripts into compiled malware along the way.
Fetterman framed the shift as one of effort displacement, with expanding portions of the attack chain now running without an operator. Human attackers are bound by "attention, working hours, and cognitive load," he wrote, while the model panel answers every five to 15 minutes, indefinitely. In his assessment, defenders still have an open window to study the transition before it becomes ordinary.