Talos finds the first malware that lets LLMs choose its attacks

Cisco Talos has published what it calls the first publicly documented Windows implant to hand its command and control over to artificial intelligence. The binary, named CLOSEDQUORUM, was found through CAIRN, a toolkit Talos released the same day for hunting malware that has AI built into it. Once deployed, the implant picks its next move by asking a panel of commercial language models and doing what they agree on, with the stated aim of harvesting credentials and crypto wallets.

How a quorum of models decides

The panel can hold up to four providers: DeepSeek, Qwen, Mistral and Google Gemini. Each is queried in sequence, each returns an independent verdict, and the action with the most votes is the one that runs. Ties are not left to chance. Talos says a fixed order of preference settles them — DeepSeek first, then Qwen, then Mistral, then Gemini — because the vote-counting loop keeps the first maximum it meets. The models are not free to answer in prose. They must return a typed JSON object whose decision field names one of a fixed set of capabilities, and the system prompt lifted out of the binary reads: you are an advanced malware strategist, provide only executable decisions. Anything that does not match is thrown away.

What happens when the vote lands

A steal decision runs all three of its collectors at once: LSASS dumping for Windows credentials, saved-passwords theft aimed at Chrome, Edge and Firefox, and wallet extraction covering MetaMask, Exodus and Ethereum. An inject decision generates shellcode and then either injects it through an Early Bird APC routine or hollows out a suspended process. A persist decision writes a WindowsUpdate value into the current user’s Registry Run key and creates a scheduled task through schtasks.exe. The operator gets the result through a Discord webhook that reports the winning decision, the target process and the model’s own reasoning for it, while stolen material arrives in the channel encrypted with AES-256-GCM.

What Talos is careful not to claim

Talos has not confirmed that this thing has been used against anyone. The distribution build it analysed ships with placeholder API keys and a dummy webhook, so the researchers never watched the full loop run end to end; what they could confirm came from static analysis of the decision logic and from development builds that inject provider credentials at compile time. Artifacts in the binary tied its developer to carding-forum postings that go back to 2025. The claim being made is narrower than the headlines it will attract: this is the first such implant anyone has written up, not the first one that exists.

Our opinion

The interesting thing here is that nothing was broken to make this work. No jailbreak is needed, no model was tricked, and every provider in the quorum behaved exactly as its terms of service intend — the developer simply wrote a narrow work order and let the models fill it in. Read the design as engineering rather than as an escalation and it looks almost sensible: a fixed JSON schema makes a stochastic system safe to compile against, and a plurality vote is the cheapest way to paper over the fact that any single model might refuse, hallucinate a field or go offline halfway through a job. That is a reliability decision, not a wizardry one, and it is also why this is going to become ordinary. The genuinely new part is the discovery method, not the malware: Talos went looking in the place attackers leave prompts and provider endpoints behind, and found a sample that was sitting in the open. The tooling found what the tooling was built to find, and the same evidence trail that identified this developer will identify the next one.