"The session is closed; no humans are admitted," Talos analyst Ryan Fetterman wrote, summarizing how a newly discovered Windows implant delegates judgment to large language models.
How CLOSEDQUORUM delegates decisions to LLMs
CISCO Talos researchers described CLOSEDQUORUM as a Go-based Windows malware that queries up to four large language model (LLM) providers — Google Gemini, DeepSeek, Qwen, and Mistral — to select its next post-compromise action. Talos said the binary delegates its next action to a quorum of LLMs that vote in sequence; if the vote is tied, DeepSeek’s vote takes precedence, followed by Qwen, Mistral, and Gemini. “Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment,” Fetterman wrote.
Talos characterized the arrangement as a form of “effort displacement,” transferring a phase of the attack from a human operator to AI systems. Fetterman emphasized the operational effect: “Human operators are bound by attention, working hours, and cognitive load,” he wrote. “An AI system capable of executing a phase of the attack chain can continue when the operator is no longer watching. It does not go offline when the attacker sleeps.”
Capability modules: Steal, Inject, Persist
The LLMs do not produce arbitrary actions. Talos extracted a system prompt from the binary that instructs each model: “You are an advanced malware strategist.” Models must choose “ONLY executable decisions” from a fixed set of capability modules.
- Steal — runs commands to dump LSASS memory for Windows credentials, steal saved browser passwords across Google Chrome, Microsoft Edge, and Mozilla Firefox, and extract cryptocurrency wallet data including MetaMask, Exodus, and Ethereum.
- Inject — generates shellcode and uses process hollowing or Early Bird injection to execute malicious code.
- Persist — establishes persistence on the infected device.
Talos reported that the models’ decisions are constrained to those predefined capabilities; the binary then executes the chosen module without further human direction.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCisco Talos discovery and the CAIRN toolkit
Talos discovered the CLOSEDQUORUM binary while using its CAIRN (Cognitive Artifact Intelligence Research Network) toolkit, which the security shop designed for hunting, classifying, and tracking emerging AI-integrated malware. Talos made CAIRN available as an open source repository on Tuesday.
While Talos said it has not observed any in‑the‑wild deployment of CLOSEDQUORUM, the researchers noted that artifacts from the binary link the malware’s developer to postings dating back to 2025 on criminal forums related to carding.
Compile-time customization and encrypted exfiltration to Discord
Talos’ analysis indicates the developer supplies each operator with a customized executable: the operator’s Discord webhook and LLM API keys are injected into the binary at compile time. Stolen credentials are sent to the operator’s Discord channel and are encrypted with AES-256-GCM, using a daily rotating key that the operator derives from the message timestamp, Talos reported.
Those operational details show the malware’s design for hands-off operation: model-driven choice, compile-time operator identifiers, and automated, encrypted exfiltration to a prearranged channel.
Talos' detection guidance: behavior over domain blocking
Talos recommended defenders prioritize behavioral detection rather than simple domain blocking. “Legitimate applications may contact DeepSeek, OpenRouter, Mistral, Gemini, or Discord independently,” Fetterman wrote. “Far fewer should contact several of them while also accessing LSASS, injecting into suspended processes, or creating WMI persistence.”
In short, the combination of multiple LLM provider contacts with high-risk host behaviors — memory dumping, credential theft activity, process injection, and persistence mechanisms — is what Talos calls the “most useful detection strategy.”
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Talos’ findings suggest monitoring for behavioral patterns that combine LLM queries with credential-theft activity and process injection. Detection should correlate outbound requests to multiple LLM providers with local actions such as LSASS access, process hollowing, or WMI persistence.
- Procurement and app owners: the binary’s use of compile-time injected webhooks and API keys shows how a single customized executable can tie an operator to specific channels; supply-chain and build-process controls that prevent unauthorized injection of identifiers at compile time will be relevant.
- End users: the Steal module’s targeting of saved browser passwords and common crypto wallets (MetaMask, Exodus, Ethereum) underscores continued risk from credentials and local wallet data on compromised devices.
CLOSEDQUORUM, as Talos reported, represents a step toward removing the human bottleneck from a phase of the attack chain by outsourcing decision-making to a small ensemble of LLMs. Talos’ public release of the CAIRN toolkit and the behavioral detection guidance gives defenders concrete signals to hunt for — and leaves open the question the analysts flagged implicitly: if models can be asked to make executable choices today under strict prompts, how will defenders calibrate detection and response as adversaries iterate on that approach?
