Cisco Talos security researchers have discovered a new malware called "CLOSEDQUORUM" that shows the role of artificial intelligence in cyberattacks can go beyond generating malicious code or crafting phishing content.
According to ITNA quoting Techspot, this malware uses four large language models - DeepSeek, Cohere, Mistral and Google’s Gemini - to decide its next action on a victim’s computer.
After infiltrating a system, CLOSEDQUORUM can use the responses of AI models to determine its behavior, and according to Cisco Talos findings, there is no clear internal pathway to receive instructions from a human operator. Using multiple AI services simultaneously also allows the malware to fall back to another service if one is unavailable. This feature can increase the flexibility and resilience of its command-and-control apparatus.
Researchers say this malware is designed to steal account and cryptocurrency credentials. Links have also been found between it and activity observed in cybercrime forums, including credit card fraud in 2025; however, the identity of its creators and actual use against victims have not been determined.
The discovery of CLOSEDQUORUM occurred during the development of the open-source framework "Cognitive Artifacts Information Research Network" or "CAIRN." This tool assists researchers in identifying and classifying AI-equipped malware samples by examining metadata and technical indicators related to AI usage.
Previously, samples like "LAMEHUG" mostly used language models to receive commands or to assist in executing part of an attack. But CLOSEDQUORUM shows that large language models can directly become part of an attack’s operational infrastructure. Cisco Talos has identified about 20 other samples of malware with AI capabilities so far; however, researchers emphasize that this field remains largely experimental.