A new Windows malware strain called CLOSEDQUORUM has been discovered that can autonomously select its post-compromise actions using large language models from multiple providers including Google Gemini, DeepSeek, Qwen, and Mistral. According to Cisco Talos, this represents the first publicly documented Windows implant to use AI models for command-and-control operations, with the malware requiring no continued human operator intervention once deployed. This approach compounds the threat by removing the human bottleneck from attacks, allowing malicious operations to continue autonomously at all hours without operator oversight.

The Go-based malware operates by querying up to four LLM providers in sequence, with each model voting on which predefined action to execute next; in case of a tie, DeepSeek's decision takes precedence. The available actions are limited to three modules: Steal (extracting Windows credentials from LSASS memory, browser passwords from Chrome, Edge and Firefox, and cryptocurrency wallets), Inject (deploying shellcode through process hollowing), and Persist (establishing device persistence). Whilst the malware has not yet been observed in active deployment, Talos discovered it using their new CAIRN toolkit and linked the developer to criminal forum postings from 2025 related to carding. Stolen credentials are exfiltrated to the operator's Discord channel using AES-256-GCM encryption with a daily rotating key, and detection requires monitoring for the combination of contacts to multiple LLM providers alongside LSASS dumping and process injection.