Cisco Talos uncovered CLOSEDQUORUM, a Windows malware that lets up to four AI models vote on stealing credentials, browser passwords, or crypto wallet data. But does it actually work?
Imagine malware that doesn't wait for a hacker's command. Instead, it asks a panel of AI models to vote on what to do next. That's exactly what Cisco Talos researchers described on September 22 when they unveiled a Windows malware strain called CLOSEDQUORUM.
This isn't your typical remote-controlled attack. The malware is designed to consult up to four AI models, which then vote on the next action. The choices? Steal Windows credentials, grab saved browser passwords, or swipe crypto wallet data. It's like giving a burglar a committee of advisors.
But here's the kicker: Talos hasn't seen this setup work from start to finish. And the public version of the malware? It doesn't function as intended. So while the concept is chilling, the execution is still flawed.
### How CLOSEDQUORUM Works (or Tries To)
At its core, CLOSEDQUORUM is a Windows malware that replaces the traditional command-and-control server with a local voting system. Instead of phoning home to a human attacker, it queries multiple AI models. Each model gets a say, and the majority vote decides the next move.
- **Steal Windows credentials:** The malware could harvest login details from the operating system.
- **Grab saved browser passwords:** It might pull passwords stored in Chrome, Edge, or Firefox.
- **Swip crypto wallet data:** It could target cryptocurrency wallets, potentially draining funds.
The idea is to make the malware more autonomous and harder to trace. No central server means fewer breadcrumbs for investigators to follow. But according to Talos, the public version is more of a proof of concept than a working threat.
### Why This Matters for Your Security
Even if CLOSEDQUORUM isn't fully operational, it signals a shift in how malware could evolve. AI models are getting cheaper and more accessible. It's not far-fetched to think attackers will refine this approach.
> "The models can choose to steal Windows credentials, saved browser passwords, and crypto wallet data," Talos noted. That's a triple threat for anyone who stores sensitive information on their PC.
For now, the best defense is the same as always: keep your software updated, use a password manager, and enable two-factor authentication wherever possible. But keep an eye on this space. AI-driven malware is a trend worth watching.
### What's Next?
Talos hasn't observed a full attack chain, and the public malware sample is broken. That gives defenders a rare head start. Researchers can study the code, understand the voting mechanism, and build countermeasures before it becomes a real problem.
But don't get too comfortable. The concept alone shows how attackers are thinking. They're experimenting with AI to automate decisions and reduce their own risk. If they crack the code, we could see a new wave of adaptive malware that's harder to predict and stop.
For now, treat this as a warning shot. The malware may not work yet, but the blueprint is out there. Stay informed, stay patched, and don't underestimate the creativity of cybercriminals.
