Product1 publisher3 min readPublished
Talos details a credential stealer that asks four commercial model APIs what to do next
Cisco Talos has published CLOSEDQUORUM, a Windows credential stealer with no command-and-control server. It hands the state of the infected host to Gemini, DeepSeek, Qwen and Mistral, then acts on the majority verdict.
The Product Desk · Product desk
What happened
- Cisco Talos detailed CLOSEDQUORUM, a Windows credential stealer that takes its orders from no command-and-control server and instead puts its tactical decisions to a vote among four commercial large language models.
- Whichever decision draws the most votes wins, DeepSeek holds the tie-break, and the winning call is handed to one of four modules for credential theft, code injection, persistence or lateral movement.
- The steal module runs three routines at once, pulling Windows credentials from process memory, saved passwords from Chrome, Edge and Firefox, and wallet files from MetaMask, Exodus and Ethereum keystores.
- Talos holds six samples covering about a week of the developer's build chain, with artifacts tying that developer to criminal forum accounts that have been posting about carding since 2025.
- The hunting toolkit that found it, CAIRN, is on GitHub and works from file metadata, so an analyst does not have to download or detonate anything to run it.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- exposure Every round ships a description of the victim machine to four separate commercial providers, so the details of an intrusion sit inside four vendors' inference pipelines before any defender sees them.
- capability With the decision loop outsourced, part of the attack chain runs with nobody at the keyboard, so a response plan built around an adversary's working hours no longer describes the opponent.
- precedent Talos watched one evasion trick travel from a red team instructor into independent actors' compiled malware inside 12 months. The expected copy time for this design is the same.
- cost Blocking commercial model endpoints at the perimeter also blocks the developers and the AI features they are shipping, so the cheaper path lands on whoever has to enumerate hosts and processes by name.
Start with the proxy log. An unsigned 16.4-megabyte Go binary on a Windows machine opens an outbound connection to a commercial model provider, sends a description of the host it is sitting on, and comes back a few minutes later to do it again [5]. At the network layer that looks like a developer pasting a stack trace into Gemini.
Talos puts the interval at every five to 15 minutes, four models per round [4]. One infected host therefore produces between 384 and 1,152 model API calls a day [23]. Polling that regular is what beacon detection was built to find, and the destinations are domains a lot of companies allow on purpose.
Each model gets the state of the host under a system prompt telling it that it is "an advanced malware strategist" and should return only executable decisions [5]. "The session is closed; no humans are admitted," Talos researcher Ryan Fetterman wrote in a blog post [8]. "Four models are queried in sequence, their independent verdicts tallied, and the binary acts, based on their judgment," he wrote [9].
CAIRN's 24 acquisition filters look for what AI integration leaves behind in a file: calls to commercial model providers, Python framework imports, local model runtimes, and natural-language text planted to derail an automated analyst [17]. YARA rules sort the hits into three tiers, from the bare presence of AI components up to named families, and an embedding model groups samples that share no strings [18]. All of it works over binaries a team has already collected, and it does not reach the wire-level version the proxy log implies.
The stolen data never touches the model APIs. The haul leaves encrypted through Discord webhooks [11], and the binary holds its position with registry run keys, scheduled tasks and Windows Management Instrumentation subscriptions, with Windows event tracing suppressed [12].
Nothing yet suggests CLOSEDQUORUM has been used against anyone, according to Talos [13]. Its assessment is a credentials-as-a-service operation, with the developer building customized binaries and the buyer handling delivery [15]. No other Windows malware has been publicly documented handing tactical decisions to a model panel, the researchers wrote [3].
The filters have been running over samples collected since July 2025. When the hunts started, a language model was an optional feature bolted onto a payload; a calendar year later the models were running the payload [19]. Fetterman wrote that human attackers are bound by "attention, working hours, and cognitive load" [21]. His assessment is that defenders still have an open window to study the transition before it becomes ordinary [22].
What this puts on a security team's desk is an inventory problem. Draw two axes: outbound traffic to a commercial model endpoint, expected or not, against the process that made it, inventoried and signed or not. Three of those cells are your own AI adoption and your own noise. The fourth, an uninventoried binary on a host with no business reason to call a model provider, is the only one carrying a signal, and it stays empty until someone writes down which hosts and which processes belong in the expected column.
What to watch
- Whether a CLOSEDQUORUM sample turns up in an actual intrusion, not just the six builds Talos collected from the developer.
- Whether Google, DeepSeek, Qwen or Mistral say anything about the accounts and traffic behind the panel queries.
- Whether the four-model vote design shows up in samples from actors unconnected to this developer.