Talos finds Windows malware designed to take tactical orders from AI models

Cisco Talos researchers identified a Windows credential stealer designed to ask up to four commercial AI models what action to take next. The malware, called CLOSEDQUORUM, describes an infected computer to the models and follows the action receiving the most votes: steal data, inject code, remain installed or move. Its design replaces an attacker-run command server with requests to AI services also used by legitimate applications. Talos found that the distributed binary had placeholder API keys and a dummy Discord endpoint, so researchers did not observe the full decision process or confirm any victims.