<![CDATA[New ClosedQuorum Windows malware uses AI for attack decisions]]>A newly discovered Windows malware family called ClosedQuorum is notable for using large language models to make its own operational decisions after a system has been compromised. According to the research, the malware queries Google Gemini, DeepSeek, Qwen, and Mistral AI to autonomously determine which actions to take during post-compromise stages of an attack. This marks a shift from static, pre-programmed malware behavior toward AI-driven decision-making, where the model itself helps select the next step rather than following a fixed set of instructions.

Key points from the reporting:

  • ClosedQuorum targets Windows systems.
  • It leverages multiple AI models, specifically Google Gemini, DeepSeek, Qwen, and Mistral AI.
  • The AI is used for autonomous decision-making during post-compromise activity, not merely for generating text or phishing lures.
  • The exact technical details of the command-and-control flow and the specific prompts used were not fully detailed in the source.

At this stage, no specific CVE identifier has been published in connection with this malware, and no KB numbers or advisory IDs were provided. Defenders should treat this as an emerging threat class rather than a patchable software flaw. Because the malware relies on external AI model APIs, network monitoring for unusual outbound requests to AI service endpoints may help surface related activity.

Source: BleepingComputer

How is your organization approaching the risk of malware that calls out to public AI models to drive its own decisions?

]]>https://xploitlk.com/topic/428/new-closedquorum-windows-malware-uses-ai-for-attack-decisionsRSS for NodeTue, 27 Oct 2026 08:15:59 GMTTue, 22 Sep 2026 18:30:22 GMT60