AI-Powered Windows Malware Uses Model Voting for Attacks

Introduction

The cybersecurity landscape is constantly evolving, and threat actors are increasingly experimenting with artificial intelligence to enhance their tools. One recent example, identified by Cisco Talos and named CLOSEDQUORUM, demonstrates a fresh twist on malware command‑and‑control: the malicious program does not wait for instructions from a central server. Instead, it consults a small ensemble of AI models, each casting a vote on what action the malware should take next. This approach aims to make the malware’s behavior less predictable and harder to block using traditional signature‑based defenses.

Although the proof‑of‑concept version circulating in the wild does not yet execute a full attack chain, the underlying idea reveals a potential future where malware can autonomously adapt its tactics based on learned models. In the following sections we explore how the voting mechanism works, what capabilities the malware is designed to exhibit, and the current limitations observed by researchers.

How the AI Voting Mechanism Works

At the core of CLOSEDQUORUM is a modular decision‑making component that loads up to four separate AI models. Each model receives the same contextual input—such as the current system state, available user data, and environmental cues—and independently predicts a suitable next step, such as credential harvesting, keylogging, or network reconnaissance. The malware then tallies the votes; the action with the majority support is executed. If a tie occurs, a predefined fallback routine selects a safe, low‑risk operation to avoid detection.

This design introduces nondeterminism into the malware’s behavior. Because the models may produce different outputs based on slight variations in input or internal randomness, the sequence of actions can differ from one infection to another, complicating efforts by security products that rely on static patterns or known command‑and‑control infrastructure.

Capabilities and Observed Behaviors

According to Talos analysis, the models embedded in CLOSEDQUORUM are trained to favor actions that yield high‑value data with minimal exposure. The primary objectives identified include:

• Extracting Windows account credentials from memory or registry hives.
• Harvesting saved passwords from popular web browsers.
• Scanning for and exfiltrating cryptocurrency wallet files and private keys.
• Collecting system information that could facilitate lateral movement within a network.

The malware also contains routines to evade common detection techniques, such as process injection, obfuscated API calls, and temporary file cleanup after data theft. While these features are present in the codebase, the current build fails to complete the full cycle due to missing or misconfigured model files, which prevents the voting system from reaching a decisive outcome in the wild.

Challenges and Limitations Seen by Researchers

Despite its innovative approach, CLOSEDQUORUM faces several practical hurdles that limit its effectiveness as a threat today. First, the AI models require specific runtime environments and dependencies that are not automatically provisioned on compromised machines. Second, the voting logic depends on a consensus mechanism; if the models disagree or produce ambiguous outputs, the malware may stall or default to benign actions, reducing its impact. Third, the lack of a fully functional command‑and‑control channel means that even when a decision is made, the malware has no reliable way to exfiltrate stolen data back to the attacker.

These shortcomings suggest that CLOSEDQUORUM is likely a research prototype or a proof‑of‑concept designed to explore the feasibility of AI‑driven malware rather than a ready‑to‑deploy weapon. Nevertheless, the concept highlights a direction that threat actors may pursue as AI tooling becomes more accessible and easier to embed within malicious payloads.

Conclusion

CLOSEDQUORUM provides a fascinating glimpse into how artificial intelligence could be reshaping the tactics of cyber adversaries. While the current iteration remains incomplete and non‑functional in practice, the underlying principle of letting AI models vote on malicious actions demonstrates a new layer of complexity that security teams must anticipate. Staying ahead of such innovations requires continuous investment in advanced detection technologies, threat intelligence, and skilled analyst teams capable of interpreting anomalous behavior.

At Grivyonx Cloud, we specialize in harnessing AI to strengthen cybersecurity defenses—helping organizations detect, analyze, and respond to emerging threats with speed and precision. Our platform combines automated behavior analysis with expert insight to keep your environment resilient against the next generation of attacks.