Malik Haidar is a veteran in the cybersecurity arena, renowned for his ability to dissect complex threats within massive corporate infrastructures. With a career built on high-stakes intelligence and strategic security, he bridges the gap between technical malware analysis and the broader business implications of cyber warfare. Today, we sit down to discuss a paradigm shift in the threat landscape: CLOSEDQUORUM, a Windows malware that effectively replaces the traditional human-operated command-and-control server with a democratic “board” of artificial intelligence models. This development signals a new era where attackers leverage commercial AI services like DeepSeek and Google Gemini to autonomously navigate compromised systems, presenting a cold, calculated efficiency that challenges our traditional defense models.
Our conversation explores the mechanics of AI-driven decision-making in malware, the specific destructive capabilities of these autonomous tools, and the subtle digital footprints they leave behind for defenders to track. We also delve into the technical nuances of the malware’s “steal,” “inject,” and “persist” functions, and how the use of common platforms like Discord complicates the detection of data exfiltration.
How does delegating decision-making to a quorum of AI services like DeepSeek, Qwen, Mistral, and Gemini change the traditional relationship between an attacker and their malware?
This shift effectively severs the umbilical cord between the attacker and the infected host, creating a level of autonomy we haven’t seen in the wild before. Traditionally, an attacker had to manually send commands from a central server, which created a clear target for defenders to block or take down. By using a quorum of four commercial AI models, the developer of CLOSEDQUORUM has offloaded the tactical thinking to third-party providers who have no idea they are participating in a heist. It’s a chilling realization for a security professional to see a piece of code that can “think” for itself based on the specific environment it finds, such as checking if it has administrator status before deciding to strike. This move makes the attack more resilient because the “brain” of the operation is distributed across several legitimate, high-availability services that businesses cannot easily block without disrupting their own legitimate AI workflows.
Could you walk us through the technical orchestration of this “voting” process and what happens if the AI models fail to reach a consensus?
The process is remarkably structured, almost like a corporate board meeting occurring in the background of a victim’s processor. The malware gathers basic telemetry—the computer name, the specific Windows version, and whether the current user has elevated privileges—and presents this data along with a fixed menu of malicious actions to the AI models. For a decision to be finalized, the models must respond in a very specific format; if a model’s output is garbled or off-script, the malware simply tosses it out like a spoiled ballot. It then tallies the votes for actions like “steal” or “persist” and proceeds with the winner. If no clear consensus is reached or the models return unusable data, the malware doesn’t just guess or give up; it remains dormant, waiting for a few minutes before trying the process again, showing a level of patience that mimics a human intruder.
Once the “steal” action is democratically selected by the models, what specific high-value targets is this malware designed to harvest from a compromised Windows environment?
When the AI quorum triggers the “steal” command, the malware initiates a multi-pronged assault on the victim’s digital identity and assets. It immediately goes for the throat of Windows security by dumping the memory of the LSASS process, which is where the most sensitive login credentials live. Simultaneously, it scrapes the local databases of browsers like Chrome, Edge, and Firefox to extract every saved password it can find. Perhaps most critically in today’s economy, it targets crypto-currency infrastructure, specifically hunting for data from MetaMask, Exodus, and Ethereum wallets. Watching this happen in a sandbox environment is harrowing because it’s a total liquidation of a user’s digital life, all happening within seconds of the AI’s “decision.”
From a persistence standpoint, how does the malware use Windows system components to ensure it remains active, and how does it disguise these activities?
Persistence is where CLOSEDQUORUM shows its craftier side, using a “hide in plain sight” strategy that exploits common administrative tools. It establishes three different anchors: a Registry Run key for the current user, a scheduled task, and a WMI event subscription. What’s particularly deceptive is that the Registry value and WMI names are all themed around “Windows Update,” making them look like routine system maintenance to a tired IT admin scanning a list of a thousand processes. The WMI event is programmed to kick-start the malware every 60 seconds, ensuring that even if one component is killed, the infection remains a constant, rhythmic presence on the machine. This relentless cycle of self-revival is a nightmare for remediation teams who find the threat reappearing just moments after they think they’ve purged it.
The use of Discord webhooks for data exfiltration is a clever choice—how does the malware manage the flow of stolen information to avoid triggering network alarms?
Exfiltration is often the loudest part of a breach, but this malware tries to whisper by using a slow-drip method via Discord webhooks. Once the data is gathered, the malware encrypts it and shatters it into small, 1,900-byte pieces, which are then posted to the attacker’s Discord channel. By sending only one of these tiny fragments per second, it avoids the massive spikes in outbound traffic that usually set off Data Loss Prevention (DLP) alerts. The attacker receives a steady stream of notifications in their Discord channel, including the AI’s stated reason for each choice, making the chat app a macabre control room for the theft. This method leverages the trust we place in Discord as a communication tool, making the malicious traffic look like any other developer or gamer interacting with their community.
Looking at the broader evolution of AI in cybercrime, how does the logic behind CLOSEDQUORUM differ from previous threats like the LAMEHUG malware we saw in 2025?
The evolution from LAMEHUG to CLOSEDQUORUM marks a transition from AI being a “writer” to AI being a “manager.” In 2025, LAMEHUG used AI primarily to generate the specific commands for tasks that were already hard-coded into its logic; it was essentially using the LLM as a sophisticated scriptwriter. CLOSEDQUORUM takes a giant leap forward by asking the AI to actually choose the task itself based on the situational context of the target machine. This is a fundamental shift toward truly autonomous malware where the human developer provides the tools, but the AI provides the strategy. It represents an early, yet highly alarming, example of attackers delegating the most critical part of an intrusion—the “what’s next?”—to an automated system.
What is your forecast for the future of AI-driven autonomous malware?
I expect we will see a rapid maturation of these “quorum” models where malware doesn’t just ask for a vote on four pre-set actions, but engages in a more complex, multi-step reasoning process to bypass specific EDR or XDR solutions. We are likely moving toward a reality where malware can dynamically rewrite its own code on the fly based on the defensive barriers it encounters, using AI to perform real-time vulnerability research on its target. Defenders will need to move away from simple domain blocking and toward deep TLS inspection and behavioral analysis, because when the adversary is an ensemble of AI models, the “attack signature” changes with every heartbeat. The battle will increasingly be fought at the speed of silicon, and our traditional human-in-the-loop defense strategies will be pushed to their absolute breaking point.
