On September 22, Cisco Talos disclosed a Windows malware family tracked as CLOSEDQUORUM that represents a genuine architectural shift in how malware receives its tasking. Instead of beaconing to a traditional attacker-controlled command-and-control (C2) server, CLOSEDQUORUM is built to query up to four AI models and let them vote on its next action. The candidate actions on the ballot are exactly what you'd expect from a modern infostealer: harvesting Windows credentials, extracting saved browser passwords, and stealing cryptocurrency wallet data.
Two facts from the Talos report should shape your response posture. First, Talos has not observed this mechanism working end-to-end in the wild — the publicly available version of the malware is non-functional as distributed. Second, that doesn't make this a non-event. CLOSEDQUORUM is a working proof-of-concept for a design pattern that solves the attacker's oldest problem: C2 infrastructure that defenders can block, sinkhole, and attribute. An LLM-voting scheme replaces a hardcoded C2 domain with legitimate, broadly allowlisted AI API endpoints. When a functional variant of this lands — and it will — the network-based detections most SOCs rely on for infostealer triage will be significantly weaker.
Defenders should treat this as an early-warning engagement: instrument the behaviors now, while the threat is still theoretical, rather than after the first working sample ships.
Technical Analysis
What CLOSEDQUORUM Is
CLOSEDQUORUM is a Windows malware family analyzed by Cisco Talos and publicly reported on September 22, 2026. Its defining characteristic is its decision-making architecture:
- LLM quorum for tasking: Rather than pulling an instruction set from an attacker's server, the malware is designed to submit prompts to up to four AI models. The models' responses are aggregated — a vote — and the majority decision determines which malicious capability executes next.
- Modular payload options: The actions the models can select from include:
- Theft of Windows credentials (DPAPI-protected secrets, credential stores)
- Extraction of saved browser passwords (Chromium
Login Data/Local State, Firefoxlogins.jsonandkey4.db) - Cryptocurrency wallet data theft (desktop wallet files and browser extension wallet stores)
- Broken as distributed: The public version does not function as-is, and Talos has not observed a complete, successful execution of the quorum mechanism in the wild. This is an emerging capability, not an active campaign.
Why This Architecture Matters to Defenders
Traditional infostealer detection leans heavily on two pillars: known-bad C2 infrastructure (domains, IPs, JA3/JA4 fingerprints) and beaconing behavior (periodic outbound connections to low-reputation hosts). An LLM-tasked design undermines both:
- The "C2" is a legitimate SaaS endpoint. API calls to major AI providers ride over TLS to domains that are allowlisted in most enterprise egress policies and are indistinguishable from legitimate developer or productivity traffic at the destination level.
- No operator infrastructure to enumerate. There is no attacker VPS to sinkhole, no domain to add to a block list, no passive DNS trail to pivot on. The prompt-and-response channel looks like ordinary API consumption.
- Decision logic is offloaded. Because the models choose the next action, the malware's behavior can vary per victim and per run without any code change — complicating signature development and sandbox detonation timelines.
What Stays the Same: The Endpoint Behaviors
Here is the critical defensive insight: the quorum mechanism changes how the malware decides, not what it does. Whether the order comes from a bulletproof-hosted C2 or a majority vote of four LLMs, stealing a Chrome password still requires reading Login Data, decrypting it with DPAPI, and touching Local State for the master key. Stealing a wallet still requires reading Electrum, Exodus, or MetaMask extension storage. Those endpoint behaviors are stable, well-understood, and highly detectable with existing telemetry.
Your detection strategy should therefore be two-pronged:
- Behavioral detections on the theft actions themselves — these catch CLOSEDQUORUM and every other infostealer using the same techniques, regardless of tasking channel.
- Anomaly detection on LLM API usage — non-developer processes, browsers excluded, establishing TLS sessions to AI provider API endpoints is a strong hunting signal in most environments.
Exploitation Status
- In-the-wild exploitation: Not observed. Talos explicitly notes the quorum mechanism has not been seen working end-to-end.
- Public sample functionality: The public version is non-functional as distributed.
- CVE / CISA KEV: None assigned — this is a malware family, not a vulnerability.
- Risk assessment: Low immediate risk, high trajectory risk. Treat as a threat-hunting and detection-engineering priority, not an emergency patching event.
Detection & Response
The detections below target the stable, observable behaviors: credential store access, wallet file access, and anomalous outbound connections to LLM API endpoints. They are tuned to minimize noise — each rule includes explicit false-positive considerations.
Sigma Rules
---
title: Non-Browser Process Access to Browser Credential Stores
id: 8f3a2c71-4b6d-4e9a-b1c5-7d2e9f4a6b8c
status: experimental
description: Detects processes outside of the legitimate browser accessing Chromium or Firefox credential databases, consistent with infostealer behavior including the browser password theft capability described for CLOSEDQUORUM.
references:
- https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html
- https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/09/23
tags:
- attack.credential_access
- attack.t1555.003
logsource:
category: file_event
product: windows
detection:
selection_paths:
TargetFilename|contains:
- '\Google\Chrome\User Data\'
- '\Microsoft\Edge\User Data\'
- '\BraveSoftware\Brave-Browser\User Data\'
- '\Mozilla\Firefox\Profiles\'
selection_files:
TargetFilename|endswith:
- '\Login Data'
- '\Local State'
- '\logins.json'
- '\key4.db'
- '\Cookies'
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\brave.exe'
- '\firefox.exe'
- '\MsMpEng.exe'
- '\SearchIndexer.exe'
condition: selection_paths and selection_files and not filter_browsers
falsepositives:
- Enterprise backup and DLP agents reading browser profiles (tune by Image path)
- EDR/AV scanners during on-access scans
level: high
---
title: Outbound Connection to LLM API Endpoint by Uncommon Process
id: 2c7e9a14-6d3b-4f8a-a5e2-9b1d4c6f8e3a
status: experimental
description: Detects network connections to major AI provider API endpoints from processes other than browsers and known developer tools. CLOSEDQUORUM is designed to take tasking from a vote of up to four AI models, requiring outbound API calls to LLM providers.
references:
- https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html
- https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/09/23
tags:
- attack.command_and_control
- attack.t1102.002
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains:
- 'api.openai.com'
- 'api.anthropic.com'
- 'generativelanguage.googleapis.com'
- 'api.mistral.ai'
- 'api.cohere.com'
- 'openai.azure.com'
filter_legit:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\Code.exe'
- '\cursor.exe'
- '\python.exe'
- '\node.exe'
condition: selection and not filter_legit
falsepositives:
- Legitimate enterprise AI-integrated applications (inventory and allowlist per environment before enforcing)
- PowerShell or scripting runtimes used by developers for API testing
level: medium
---
title: Cryptocurrency Wallet File Access by Suspicious Process
id: 5d1b8f63-2a4e-4c7d-93b1-6e8f2a5c9d7b
status: experimental
description: Detects process access to common desktop and browser-extension cryptocurrency wallet data stores, matching the wallet theft capability attributed to CLOSEDQUORUM.
references:
- https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html
- https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/09/23
tags:
- attack.collection
- attack.credential_access
- attack.t1005
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\Electrum\wallets\'
- '\Exodus\exodus.wallet\'
- '\atomic\Local Storage\leveldb\'
- '\Ethereum\keystore\'
- 'nkbihfbeogaeaoehlefnkodbefgpgknn'
- 'ejbalbakoplchlghecdalmeeeajnimhm'
filter_legit:
Image|endswith:
- '\electrum.exe'
- '\exodus.exe'
- '\chrome.exe'
- '\msedge.exe'
condition: selection and not filter_legit
falsepositives:
- Legitimate wallet applications (filtered above)
- Backup software archiving user AppData
level: high
KQL — Microsoft Sentinel / Defender Hunt
This query correlates the two strongest signals: an uncommon process talking to an LLM API endpoint and credential-store file access on the same host within a short window. Run it as a hunting query; promote to analytics rule after baseline tuning in your environment.
// Hunt: processes connecting to LLM API endpoints + browser credential store access
let llmDomains = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "api.mistral.ai", "api.cohere.com"]);
let llmConnections =
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl in (llmDomains)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "Code.exe", "cursor.exe", "python.exe", "node.exe")
| summarize LLMConnections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl;
let credStoreAccess =
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("Login Data", "Local State", "logins.json", "key4.db")
or FolderPath has_any ("\\Electrum\\wallets\\", "exodus.wallet", "\\Ethereum\\keystore\\")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "MsMpEng.exe", "SearchIndexer.exe")
| summarize CredFileAccess = count(), FilesAccessed = make_set(FolderPath, 10)
by DeviceName, InitiatingProcessFileName;
llmConnections
| join kind=inner credStoreAccess on DeviceName, InitiatingProcessFileName
| project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, LLMConnections, CredFileAccess, FilesAccessed, FirstSeen, LastSeen
| sort by LLMConnections desc;
For environments ingesting Sysmon via the SecurityEvent/Event tables, the same logic applies against Event ID 3 (network connection) and Event ID 11 (file create) with the destination hostnames and file paths above.
Velociraptor VQL — Endpoint Hunt
Use this artifact during triage of a suspected host to enumerate processes with LLM API connections and to locate staged credential/wallet data awaiting exfiltration.
-- CLOSEDQUORUM triage: processes with connections to LLM API endpoints
-- and recently accessed credential/wallet artifacts
SELECT Pid, Name, CommandLine, Exe, Username,
netstat().RemoteAddr.IP AS RemoteIP,
netstat().RemoteAddr.Port AS RemotePort,
netstat().Status AS ConnStatus
FROM pslist()
WHERE CommandLine =~ '(?i)(openai|anthropic|claude|gpt|llm|mistral|cohere)'
OR Exe =~ '(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\\ProgramData\\)'
-- Separately, enumerate staged loot: credential DBs copied outside browser dirs
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:\\Users\\**\\AppData\\Local\\Temp\\**')
WHERE FullPath =~ '(?i)(login.?data|local.?state|logins\.json|key4\.db|\.wallet|wallet\.dat|keystore)'
ORDER BY Mtime DESC
Remediation and Hardening Script — PowerShell
This script audits a Windows host for the observable artifacts of CLOSEDQUORUM-class infostealers (LLM API connections by non-browser processes, staged credential files) and validates that key credential-theft mitigations are in place. Run elevated. It makes no destructive changes — review output before acting.
# CLOSEDQUORUM-class infostealer audit & hardening verification
# Run as Administrator. Read-only audit; no system changes.
$report = @()
# 1. Check for non-browser processes with established connections to LLM API endpoints
Write-Host "[*] Checking for connections to LLM API endpoints..." -ForegroundColor Cyan
$llmIPs = @()
foreach ($domain in @("api.openai.com","api.anthropic.com","api.mistral.ai","api.cohere.com")) {
try { $llmIPs += (Resolve-DnsName -Name $domain -Type A -ErrorAction SilentlyContinue).IPAddress } catch {}
}
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
Where-Object { $llmIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
$proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
if ($proc -and $proc.ProcessName -notin @("chrome","msedge","firefox","Code","python","node")) {
$report += [PSCustomObject]@{
Check = "LLM API connection by non-browser process"
Detail = "$($proc.ProcessName) (PID $($proc.Id)) -> $($c.RemoteAddress):$($c.RemotePort)"
Severity = "HIGH"
}
}
}
# 2. Check for staged credential/wallet files in temp locations
Write-Host "[*] Scanning temp directories for staged credential artifacts..." -ForegroundColor Cyan
$loot = Get-ChildItem -Path "$env:TEMP","$env:ProgramData","C:\Users\*\AppData\Local\Temp" -Recurse -Depth 3 -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match '(?i)(login.?data|logins\.json|key4\.db|\.wallet|wallet\.dat|keystore)' } |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
foreach ($f in $loot) {
$report += [PSCustomObject]@{ Check = "Staged credential/wallet artifact"; Detail = $f.FullName; Severity = "HIGH" }
}
# 3. Verify Credential Guard status (protects LSASS/DPAPI-adjacent secrets)
Write-Host "[*] Verifying Windows Credential Guard..." -ForegroundColor Cyan
$cg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue
if ($cg -and $cg.SecurityServicesRunning -contains 1) {
$report += [PSCustomObject]@{ Check = "Credential Guard"; Detail = "Running"; Severity = "OK" }
} else {
$report += [PSCustomObject]@{ Check = "Credential Guard"; Detail = "NOT running - LSASS credentials exposed"; Severity = "MEDIUM" }
}
# 4. Verify LSA Protection (RunAsPPL)
$lsa = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RunAsPPL -ErrorAction SilentlyContinue
if ($lsa.RunAsPPL -ge 1) {
$report += [PSCustomObject]@{ Check = "LSA Protection (RunAsPPL)"; Detail = "Enabled"; Severity = "OK" }
} else {
$report += [PSCustomObject]@{ Check = "LSA Protection (RunAsPPL)"; Detail = "NOT enabled - set RunAsPPL=1 to harden LSASS"; Severity = "MEDIUM" }
}
# 5. Check SMB signing / egress posture note for AI endpoints (advisory only)
$report += [PSCustomObject]@{ Check = "Egress policy"; Detail = "Manual step: inventory which applications legitimately call LLM APIs; alert on all others at the proxy/firewall"; Severity = "INFO" }
$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\closedquorum_audit_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation
Write-Host "[*] Audit complete. Report exported to CSV." -ForegroundColor Green
Remediation and Defensive Recommendations
Because CLOSEDQUORUM is not yet functional in the wild and has no associated CVE or patch, remediation is about hardening against the techniques it intends to use and building the telemetry you'll need when a working variant appears. Prioritize the following:
- Inventory legitimate LLM API usage. This is the single highest-value action. Every enterprise now has some AI API traffic. Document which applications, service accounts, and hosts are authorized to reach AI provider endpoints, then alert on everything else at the egress proxy or firewall. An allowlist-by-exception model converts CLOSEDQUORUM's core innovation into a detection opportunity.
- Enable Windows Credential Guard and LSA Protection on all supported endpoints. These directly raise the cost of the Windows credential theft capability the malware is designed to invoke. Verify with the audit script above; note that Credential Guard requires UEFI lock and compatible hardware on older fleets.
- Deploy browser credential-store access detections (Sigma rules above). These catch the entire infostealer class — CLOSEDQUORUM, and the commodity stealers your users are far more likely to encounter this quarter. Tune out your backup agents, DLP, and EDR scanners first.
- Protect high-value wallet users. If any corporate or executive hosts hold cryptocurrency wallets (desktop or browser-extension), treat those machines as high-value assets: enforce hardware-wallet-only policies where possible, and apply the wallet-file-access detection as a high-severity alert.
- Strengthen egress monitoring beyond destination reputation. LLM API endpoints will always have pristine reputation. Shift to identity-and-process-aware egress controls: which process, under which user context, from which host, at what volume.
- Monitor Talos and community reporting for functional variants. The current sample is broken; assume that is temporary. Subscribe to Cisco Talos intelligence feeds and ensure your IR retainers and playbooks account for "C2 over legitimate SaaS" scenarios — this is the same defensive problem as C2-over-Slack, C2-over-DNS, and C2-over-M365, now extended to AI providers.
- Exercise the scenario. Add "malware tasking via LLM API" to your next tabletop or purple-team exercise. Validate that your SOC can distinguish developer AI traffic from malicious AI traffic today, because that triage question is coming.
Related Resources
Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.