Researchers say a new Windows malware called ClosedQuorum can decide for itself what to do after infecting a computer, including stealing passwords and trying to stay on the system. Cisco Talos says the Go-based implant queries Google Gemini, DeepSeek, Qwen, and Mistral in a voting system to choose among predefined actions: credential and wallet theft, shellcode-based code injection using process hollowing or Early Bird APC injection, persistence, and a currently unimplemented lateral-movement option. Stolen data is sent out through a Discord webhook.
Why it matters: This points to a practical shift toward more automated intrusions that can move faster and require less hands-on operator control once malware lands on a Windows host. Defenders should watch for Discord webhook exfiltration, unusual access to AI model APIs from endpoints, and the listed theft and injection behaviors in incident-response and endpoint-detection tooling.
info@thehackernews.com (The Hacker News)
2026.09.23
99% relevant
This article appears to cover the same malware family and core event: a Windows malware framework that queries up to four AI models—Gemini, DeepSeek, Qwen, and Mistral—and lets them 'vote' on next actions after infection.
2026.09.22
99% relevant
This article is a direct report on the same malware event, adding detail that Cisco Talos considers CLOSEDQUORUM the first publicly documented Windows implant to use LLMs for command-and-control decision making, plus specifics on its voting logic, Discord exfiltration, and post-compromise modules.
Bill Toulas
2026.09.22
100% relevant
This article appears to be the first concrete reporting on ClosedQuorum as a distinct malware family and establishes the core facts of the campaign/tooling: the malware name, Windows target, AI-model decision architecture, and observed post-compromise capabilities.
← Back to all stories