Windows Malware Uses 4 AI Models To Decide Its Next Move

A Windows malware strain is using multiple AI models to determine its next move, delegating tactical decisions to AI models, rather than relying entirely on commands from an attacker-controlled server. 

CLOSEDQUORUM, a Windows malware strain analysed by Cisco Talos, uses DeepSeek, Qwen, Mistral and Google Gemini to vote on its next action, including stealing data, injecting code or establishing persistence. It can target Windows credentials, browser passwords and crypto wallets, but Talos has not observed a full attack, and the analysed sample contains placeholder API keys and a dummy Discord webhook.

A Windows malware strain called CLOSEDQUORUM uses multiple AI models to decide what to do on an infected computer. It can query DeepSeek, Qwen, Mistral and Google Gemini, using their responses to select its next action instead of relying entirely on instructions from an attacker-controlled command-and-control server.

“Human operators are bound by attention, working hours, and cognitive load. An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching,” said Ryan Fetterman of Cisco Talos.

The models receive information about the compromised system and choose between four actions: Steal, Inject, Persist and Move. Steal can collect Windows credentials from LSASS memory, browser passwords and cryptocurrency wallet data. Inject supports techniques including process hollowing and Early Bird APC injection, while Persist can use Registry Run keys, scheduled tasks and WMI event subscriptions. Move is intended for lateral movement but is not implemented in the analysed version.

The AI models are not creating new attack techniques. They choose from capabilities already built into the malware, with the majority response determining what happens next. 

The analysed sample contains placeholder API keys and a dummy Discord webhook, meaning it does not work as distributed. Evidence also links its developer to criminal forum activity dating to 2025. The finding demonstrates that AI models can be used to automate a bounded phase of an attack, but researchers have not confirmed its use in real-world attacks.