AI malware removes humans from the attack chain

Attackers using artificial intelligence (AI) have gained significant advantages in terms of speed and scale, and now, according to Cisco Talos, AI malware has evolved to execute large parts of the attack chain without human intervention. Threat researchers at the group have identified what they call the first “LLM-as-C2” architecture that can fully automate the command and control (C2) chain.

See also: New npm malware finds way to bypass installer script defenses

The binary malware, dubbed CLOSEDQUORUM, relies on a group of large language models (LLMs) that map and execute the optimal path to steal credentials. “This is not just an augmentation of an operator’s capabilities during a session, but the transfer of the entire attack phase from the operator to the system,” Cisco Talos security and threat researcher Ryan Fettermanin a blog post.

The benefits of speed and scale are amplified because humans are no longer the bottleneck, he noted. While humans have limits in terms of working hours, attention span and cognitive load, an AI system can continue when its operators are not watching. “It doesn’t shut down when the attacker sleeps,” he said. However, Cisco Talos stressed that there is no confirmation of CLOSEDQUORUM being deployed in the wild yet.

Discovered by Cisco Talos’ new research tool, Cognitive Artifact Intelligence Research Network (CAIRN), CLOSEDQUORUM condenses decision-making around a specific attack phase into a limited set of options, giving the AI ​​the ability to act independently. The malware specifically targets Microsoft’s Local Security Subsystem Service (LSASS) to extract credentials. LSASS processes manage logins and password changes, and enforce security policies.

The extraction can extract domain and local credentials from memory. CLOSEDQUORUM also performs credential theft from browsers, specifically targeting saved passwords in Chrome, Edge, and Firefox, and seeks to extract crypto wallets, including MetaMask, Ethereum, and Exodus. The tactical knowledge is directly encoded as model-readable content, and subsequent model outputs are automatically converted into executables.

Compiled in Google’s Go programming language, the 64-bit Windows executable supports up to four LLM implementations: DeepSeek, Qwen, Mistral , and Google Gemini. After deployment, CLOSEDQUORUM asks the model team with the system prompt: “You are an advanced malware strategist. Provide ONLY executable decisions.” CLOSEDQUORUM then counts their independent decisions and acts on its goal of collecting user credentials and crypto wallets. The session closes; no humans are allowed.

The models take in content, select capabilities, provide execution parameters, and make decisions continuously without the need for ongoing human input or expert tasks handled by attacker C2 servers. “The full dynamic operation is delegated to the AI,” Fetterman explained. The LLMs vote on next actions, and the action with the most votes is automatically selected.

Importantly, the model panel is not free to respond in any format; it is limited to using a defined JSON structure with a decision field corresponding to a specific capability. Anything else is discarded. “This design reduces the model output to a limited set of executable options,” Fetterman explained. In the event of a tie, the malware decides based on model preference: DeepSeek first, then Qwen, Mistral, and finally Gemini.

See also: SLEEPWALKER Backdoor: New sophisticated malware for Windows

“The tie behavior is fully deterministic and biased towards DeepSeek,” Fetterman noted. The multi-LLM structure reduces the impact of any individual denials, timeouts, or malformed responses. Thus, “it increases the probability of reaching a valid decision, but does not guarantee it,” Fetterman explained. The quorum can reach a decision even when one or more members fail to respond or hit a deadlock.

If all models fail, this acts as a consensus, causing the loop to sleep and repeat instead of taking action. Fetterman described CLOSEDQUORUM as a credential-as-a-service model, and noted that a human operator who acquires the malware doesn’t need to be online to run their campaign. “They deploy the binary, and the LLM panel executes the attack,” he said.

“This type of scaffolding approach could easily be translated and applied to other adversary targets.” Cisco Talos discovered CLOSEDQUORUM with its new open-source tool CAIRN for searching, classifying, and tracking malware with AI integration. Released today, CAIRN is “metadata-first,” and can create structured object relationship graphs to help human defenders identify related malware families and infrastructure.

Malware samples are sent to VirusTotal, which extracts and indexes static, dynamic, reputation, and behavioral metadata. AI-related objects are highlighted by content, behavior, URLs, tags, and resource metadata, and 12 targeted filters capture different object categories (APIs, prompts, frameworks, tools, runtimes).

Findings are categorized by subject, behavioral context, and functional families; text is studied for semantic similarities and relationships; and VirusTotal maps infrastructure, variants, and campaign connections. Talos has been using CAIRN to search for malware development since July 2025, and researchers have found that the autonomous framework is changing rapidly. “The progression from ‘LLM as an optional feature’ to ‘fully autonomous multi-model consensus coordinator without human operator’ was completed within a calendar year,” Fetterman noted.

The scripts have been collected in malware, and the know-how is being learned and spread as CLOSEDQUORUM and similar techniques reach threat actors without a connection to the original malware sample. “We may be in a transient window to observe the AI ​​transition,” Fetterman noted. “AI integration is becoming commonplace across software.” CLOSEDQUORUM, in particular, has distinct characteristics: AI provider API traffic originating from unexpected Windows executables; structured prompts containing feature content or language; repeated execution at random intervals of five to 15 minutes; and Discord webhook communication from the same process or computer.

See also: Android car head units: Malware hides in updates

Intrusions are feasible with available models and “routine API access,” Fetterman noted. However, the malware technique also introduces weaknesses: Provider denials, malformed outputs, predictable ties, limited schemas, and reliance on commercial APIs can all lead to attack failure. “Autonomy doesn’t make the implant infallible; it trades some human limitations for model and infrastructure limitations,” Fetterman said. “The advantage for defenders is that this progress is just beginning.”