GoKawiilCisco Talos finds malware querying four AI chatbots to self-direct attacks
Cisco Talos researchers identified Windows malware named CLOSEDQUORUM that consults DeepSeek, Qwen, Mistral and Google Gemini to decide its next actions on infected machines, continuing to function if one service goes down. The tool, designed to steal credentials and cryptocurrency, has no built-in mechanism for human operators to issue commands directly, and Talos linked it to 2025 credit-card fraud forum activity, though the creator and any real-world targets remain unidentified.
GoKawiil's interpretation of the reporting above, not reported fact.
The find suggests malware developers are experimenting with using multiple AI models as a decision-making layer rather than just for writing code or phishing text, which could make malicious tools more resilient to takedowns of any single AI service. Talos also released an open-source framework, CAIRN, meant to detect technical fingerprints left by AI integration, which could help defenders track similar threats as this approach spreads.
- CLOSEDQUORUM malware consults four separate AI chatbots to choose its actions autonomously
- It lacks a direct human command interface, relying instead on AI-driven decisions
- Cisco Talos built the CAIRN framework to detect AI 'fingerprints' left in malware samples
YubiKey 5 NFC Security Key — With malware like CLOSEDQUORUM designed to steal login credentials, adding hardware-based two-factor authentication is one of the strongest defenses available. A YubiKey lets you secure your accounts so that even stolen passwords can't grant attackers access. It's a simple, durable way to harden your personal security against credential-theft threats.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techspot.com — Skye Jacobs, 2026-09-23
Published there as: “Researchers found malware that uses four different AI chatbots to run itself”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.