This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move

Summary: Cisco Talos said on September 22 that a Windows malware called CLOSEDQUORUM takes orders from a vote of up to four commercial AI services - DeepSeek, Qwen, Mistral, and Google Gemini - which choose among four actions: steal, inject, persist, and move. The public version does not work as it is, with placeholder API keys and Discord webhook values and no code behind the move action, and Talos has not seen the setup work from start to finish.
Bottom line: Talos calls this the first publicly documented Windows implant to hand its command-and-control decisions to AI models, and the attacker still watches each choice and its stated reason in a Discord channel - so the decision-making has moved to services the attacker does not control, which can refuse requests, rate-limit, or return broken output.

Read the original at The Hacker News ↗