DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

CLOSEDQUORUM: Malware That Asks Four Models Which Move to Make Next

#malware #aiagents #detection #credentialtheft

CLOSEDQUORUM: Malware That Asks Four Models Which Move to Make Next

Cisco Talos published an analysis of CLOSEDQUORUM on 22 September 2026, describing it as a Windows credential stealer without a command and control server in the traditional sense. The tactics are chosen by a vote among four commercial large language models. Talos states that no other publicly recorded Windows implant delegates tactical command and control decisions to a panel of models in this way.

The mechanism

The sample is a 16.4 MB Go binary. Once running, it collects host context, wraps it in a prompt, and queries Google Gemini, DeepSeek, Qwen and Mistral in sequence, repeating every 5 to 15 minutes. The embedded system prompt casts the model as a senior malware strategist and instructs it to return only directly executable decisions. The highest-vote decision is executed, and public summaries describe a fixed tie-break order that begins with DeepSeek and continues through Qwen and Mistral to Gemini.
The selected action is dispatched to a module. Public descriptions of the action set cover credential theft, code injection, persistence and lateral movement. The credential module dumps LSASS memory for Windows account secrets, reads saved passwords from Chrome, Edge and Firefox, and takes wallet data from MetaMask, Exodus and Ethereum keystore paths. Collected data is encrypted and sent to a Discord webhook, with the key rotated daily from the message timestamp in one reading. Persistence uses registry Run keys, scheduled tasks and WMI event subscriptions, and the sample overwrites the EtwEventWrite function with a return instruction to suppress event tracing.

What is not established

Talos has not confirmed deployment in real intrusions. In the publicly distributed builds the API keys are placeholders and the webhook is fake, so that build cannot function as shipped. Development builds inject real keys and a webhook at compile time, which indicates a custom distribution process rather than a single tool. Six samples were recovered across roughly one week of builds, and residual artefacts link the developer to carding forum posts from 2025. Talos assesses the model as credential-as-a-service: one party builds binaries and another delivers them.

Detection

Blocking model providers is not a viable control, because legitimate applications call the same endpoints. The useful signal is a combination observed on one host: a process contacting several unrelated model providers while also touching LSASS, injecting into another process, or writing WMI persistence. Talos released a companion toolkit, CAIRN, which stands for Cognitive Artifact Intelligence Research Network. It works from metadata rather than by executing samples, using 24 collection filters for artefacts such as provider endpoints, prompt templates, API key prefixes and guardrail-evading text, with YARA rules graded in three tiers and an embedding model that clusters samples sharing no common strings.

References

Top comments (0)