{"id":16750,"date":"2026-09-23T00:40:41","date_gmt":"2026-09-23T00:40:41","guid":{"rendered":"https:\/\/newestek.com\/?p=16750"},"modified":"2026-09-23T00:40:41","modified_gmt":"2026-09-23T00:40:41","slug":"ai-malware-just-removed-the-human-from-the-attack-loop","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16750","title":{"rendered":"AI malware just removed the human from the attack loop"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Attackers using AI have greatly benefited when it comes to speed and scale, and now, says Cisco Talos, the technology has evolved to execute large portions of the attack chain entirely without human involvement.<\/p>\n

Researchers at the threat intelligence group have identified what they call the first \u201cLLM-as-C2\u201d architecture that can fully automate the command-and-control (C2) chain. Dubbed CLOSEDQUORUM, the malware binary relies on a panel of large language model (LLM) judges to map and execute the optimal path to steal credentials.<\/p>\n

\u201cThis is not merely augmenting what an operator can accomplish in a session, but transferring an entire phase of the attack from the operator to the system,\u201d Cisco Talos security and threat researcher Ryan Fetterman<\/a> explained in a blog post<\/a>.<\/p>\n

The benefits of speed and scale are compounded because the human-in-the-loop is no longer the bottleneck, he noted. Whereas humans have limits when it comes to working hours, attention span, and cognitive load, an AI system<\/a> can continue when its operators are no longer watching. \u201cIt does not go offline when the attacker sleeps,\u201d he said.<\/p>\n

Cisco Talos emphasized, however, that there is not yet any confirmation of CLOSEDQUORUM deployment in the wild.<\/p>\n

An LLM panel producing executable decisions<\/h2>\n

Discovered by Cisco Talos\u2019 new Cognitive Artifact Intelligence Research Network<\/a> (CAIRN) research toolkit, CLOSEDQUORUM collapses decision-making around a particular attack phase into constrained choices, giving AI the ability to act independently.<\/p>\n

The malware specifically targets Microsoft\u2019s Local Security Authority Subsystem Service (LSASS) credential dumping; LSASS processes logins and password changes, and enforces security policies. Dumping can extract domain and local credentials from memory.<\/p>\n

CLOSEDQUORUM also executes browser credential theft, particularly targeting saved passwords in Chrome, Edge, and Firefox, and seeks to extract crypto wallets including MetaMask, Ethereum, and Exodus.<\/p>\n

Tactical knowledge is directly encoded as model-readable context, and subsequent model outputs are automatically converted into executables. Compiled in Google\u2019s Go programming language, the 64-bit Windows executable supports up to four LLM integrations: DeepSeek, Qwen, Mistral, and Google Gemini.<\/p>\n

After deployment, CLOSEDQUORUM queries the panel of models in sequence with the system prompt: \u2018You are an advanced malware strategist. Provide ONLY executable decisions.\u2019 CLOSEDQUORUM then tallies their independent verdicts and acts based on its goal of harvesting user credentials and crypto wallets.<\/p>\n

The session is closed; no humans are admitted. Models receive context, choose capabilities, provide execution parameters, and continuously make decisions without the need for continued human commands or tasking from dedicated, attacker-operated C2 servers.<\/p>\n

\u201cThe complete dynamic operation is delegated to the AI,\u201d Fetterman explained. The LLMs vote on next actions, and the action with the most votes is automatically selected. Importantly, the model panel is not free to respond in any format; it is constrained to using a defined JSON structure with a decision field mapping to a specific capability. Anything else is discarded.<\/p>\n

\u201cThis design reduces the model\u2019s output to a constrained set of executable choices,\u201d Fetterman explained.<\/p>\n

In the event of a tie, the malware<\/a> decides based on model preference: first DeepSeek, then Qwen, Mistral, and, finally, Gemini. \u201cThe tie behavior is fully deterministic and biased toward DeepSeek,\u201d Fetterman noted.<\/p>\n

The multi-LLM structure reduces impacts from any individual refusals, timeouts, or malformed responses. Thus, \u201cit increases the likelihood of obtaining a valid decision, but does not guarantee one,\u201d Fetterman explained. The quorum can reach a decision even when one or more member is unresponsive or hits a guardrail. If all models happen to fail, this serves as a consensus, causing the loop to sleep and retry rather than defaulting to action.<\/p>\n

Fetterman called CLOSEDQUORUM a credentials-as-a-service model, and noted that a human operator who acquires the malware does not need to be online to run their campaign. \u201cThey deploy the binary, and the LLM panel runs the attack,\u201d he said. \u201cThis type of scaffolding approach could easily be translated and applied to other adversary objectives<\/a>.\u201d<\/p>\n

A \u2018fleeting window\u2019 of AI transition<\/h2>\n

Cisco Talos discovered CLOSEDQUORUM with its new CAIRN open-source research toolkit for hunting, classifying, and tracking AI-integrated malware. Released today, CAIRN is \u201cmetadata-first,\u201d and can craft structured graphs of artifact relationships to help human defenders identify related malware families and infrastructure.<\/p>\n

Malware samples are sent to VirusTotal<\/a>, which extracts and indexes static, dynamic, reputation, and behavioral metadata. AI-related artifacts are surfaced from content, behavior, URLs, labels, and resource metadata, and 12 targeted filters capture different classes of artifacts (APIs, prompts, frameworks, tooling, runtimes).<\/p>\n

Findings are classified by artifact, behavioral context, and operational families; text is studied for semantic similarities and relationships; and VirusTotal maps infrastructure, variants, and campaign connections.<\/p>\n

Talos has used CAIRN to hunt malware development since July 2025, and the researchers have found that the autonomous framework is changing rapidly. \u201cThe progression from \u2018LLM as optional feature\u2019 to \u2018fully autonomous multi-model consensus orchestrator with no human operator\u2019 filled in within a single calendar year,\u201d Fetterman noted.<\/p>\n

Scripts have been compiled into malware, and tradecraft is being taught and spread as CLOSEDQUORUM and similar techniques reach threat actors with no connection to the original malware sample. \u201cWe may be in a fleeting window to observe AI transition,\u201d Fetterman noted. \u201cAI integration is becoming commonplace in all software.\u201d<\/p>\n

CLOSEDQUORUM in particular has distinct hallmarks: AI-provider API traffic originating from unexpected Windows executables; structured prompts containing context or capability language; repeated execution at randomized five minute to 15 minute intervals; and Discord webhook communication from the same process or host. Intrusions are achievable with currently available models and \u201cordinary API access,\u201d Fetterman noted.<\/p>\n

Still, the malware technique introduces weaknesses too: Provider refusals, malformed outputs, predictable tie-breaks, constrained schemas, and dependence on commercial APIs can all lead to attack failure.<\/p>\n

\u201cAutonomy does not make the implant infallible; it exchanges some human limitations for model and infrastructure limitations,\u201d Fetterman said. \u201cThe advantage for defenders is that this progression is still only beginning.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Attackers using AI have greatly benefited when it comes to speed and scale, and now, says Cisco Talos, the technology has evolved to execute large portions of the attack chain entirely without human involvement. Researchers at the threat intelligence group have identified what they call the first \u201cLLM-as-C2\u201d architecture that can fully automate the command-and-control (C2) chain. Dubbed CLOSEDQUORUM, the malware binary relies on a… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16750","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16750"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16750\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}