Cisco Talos researchers have analyzed a new Windows malware strain designated CLOSEDQUORUM. The malware is designed to route malicious actions through a voting mechanism involving up to four AI models rather than a traditional attacker-controlled command-and-control server. Reported capabilities include the theft of Windows credentials, saved browser passwords, and cryptocurrency wallet data. Talos has not observed the full attack chain functioning end-to-end, and the public version of the malware does not operate as intended.

What should defenders do?

Maintain updated security software and monitor for unusual process behavior on Windows systems. As the public version of CLOSEDQUORUM is non-functional, immediate patching requirements are unclear. General cybersecurity hygiene is recommended.

mediumMalware

Cisco Talos Analyzes Novel Windows Malware CLOSEDQUORUM with AI Model Voting Mechanism

Report Details Malware Designed to Orchestrate Actions via Up to Four AI Models, Though Public Version Currently Non-Functional

CyberIntel DeskPublished 5 days agoUpdated less than a minute ago1 min read

Cisco Talos Analyzes Novel Windows Malware CLOSEDQUORUM with AI Model Voting Mechanism

Key Takeaways

Cisco Talos has identified a new Windows malware strain named CLOSEDQUORUM.
The malware is designed to use a voting mechanism involving up to four AI models to determine malicious actions.
Reported capabilities include theft of Windows credentials, browser passwords, and cryptocurrency wallet data.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read