ClosedQuorum Malware Lets AI Models Decide Attack Steps
New Windows malware uses a panel of AI models to autonomously choose actions like credential theft without human input.
Key points
- ClosedQuorum uses four AI models to vote on actions like credential theft and code injection.
- The malware sends stolen data via Discord webhooks, removing the need for human operators.
- Reliance on external AI APIs creates vulnerabilities like rate limits and service outages.
A new piece of Windows malware called ClosedQuorum marks a shift in how cyberattacks are executed. Instead of waiting for instructions from a human operator, the software uses a panel of artificial intelligence models to decide its next move. This approach allows the malware to act autonomously after it has infected a computer.
The malware is written in Go and relies on four different AI services: Google Gemini, DeepSeek, Qwen, and Mistral. These models analyze the infected system and vote on which action to take next. If the vote is tied, DeepSeek has the final say, followed by the other models in a specific order. This setup removes the need for real-time human direction during the attack.
Limited menu of malicious actions
The AI models do not have free rein. They are restricted to a predefined list of commands. The most common option is to steal data, which includes dumping login credentials from system memory and extracting passwords from browsers like Chrome and Firefox. It can also target cryptocurrency wallets such as MetaMask and Exodus.
Another option is to inject code into other processes to hide its presence. The malware can also establish persistence, ensuring it remains on the system after a reboot. A fourth option for lateral movement exists in the code, but the version analyzed by researchers lacks the necessary handler to actually execute this step.
Automated data exfiltration methods
Once the malware collects the requested data, it sends it to the attackers. It uses a Discord webhook, a common tool for messaging, to transmit the stolen information. This method allows the entire attack chain to proceed without human intervention, making the operation faster and harder to disrupt through traditional command-and-control blocking.
Risks of relying on AI
Despite its autonomy, the system has significant weaknesses. Cisco Talos researchers note that the malware depends on external commercial APIs. If these services impose rate limits, return malformed data, or experience outages, the malware may fail to function. This reliance on third-party infrastructure creates a single point of failure for the attackers.
The analyzed binary contained placeholder credentials and dummy webhooks, suggesting it may be a test or experimental build. However, artifacts linked the developer to criminal forums involved in credit card fraud. BleepingComputer reports that this incident highlights a broader trend toward automating attack chains, even if the specific implementation has current limitations.
