Cisco Talos Unveils Open-Source Toolkit to Detect AI-Integrated Malware
Cisco Systems Inc.’s Talos Threat Intelligence group has introduced a new open-source toolkit designed to assist cybersecurity professionals in hunting down malware that incorporates artificial intelligence. This innovative toolkit aims to enhance the detection and analysis of increasingly sophisticated cyber threats that leverage AI capabilities.
Details on CLOSEDQUORUM Malware
The first malware sample analyzed through this toolkit is a Windows credential stealer known as CLOSEDQUORUM. Unlike conventional malware that relies on a command-and-control server, CLOSEDQUORUM makes tactical decisions through a voting process among four advanced large language models. According to Talos researchers, this approach marks a significant shift in how Windows malware operates, with no other publicly documented instances of such decision-making processes available.
Decision-Making Mechanism in AI Malware
CLOSEDQUORUM polls four AI models: Google Gemini, DeepSeek, Qwen, and Mistral, querying them every five to fifteen minutes. The malware, a 16.4 MB Go binary, provides each model with the host system’s state, instructing them to act as “advanced malware strategists” and return only actionable outcomes. The decision that receives the highest votes is enacted, with DeepSeek serving as the tiebreaker. Subsequently, the malware can execute one of four modules focused on stealing credentials, injecting code, establishing persistence, or lateral movement.
Techniques Employed by CLOSEDQUORUM
The credential-stealing module operates three collection routines concurrently, allowing it to extract Windows credentials from memory, saved passwords from popular browsers like Chrome, Edge, and Firefox, and wallet files from applications such as MetaMask, Exodus, and Ethereum keystores. The stolen data is encrypted and transmitted using Discord webhooks. In addition, the malware ensures its persistence through several Windows mechanisms, including registry run keys and task scheduling, while suppressing Windows event tracing to avoid detection.
Current Usage and Developer Background
As of now, there is no evidence indicating that CLOSEDQUORUM has been actively deployed against any victims. Talos has analyzed six samples from approximately a week’s worth of the malware’s development, revealing that the developer is linked to criminal forums that have been discussing carding activities since 2025. This suggests that CLOSEDQUORUM may operate as a credentials-as-a-service system, where the developer customizes binaries for buyers who handle the delivery.
Introducing the Cognitive Artifact Intelligence Research Network
The toolkit utilized by Talos, named the Cognitive Artifact Intelligence Research Network (CAIRN), is available on GitHub. CAIRN operates based on metadata analysis, eliminating the need to download or detonate potentially malicious files. The toolkit employs twenty-four filters to identify traces of AI integration, including calls to commercial model providers, Python framework dependencies, and any natural language text intended to mislead automated analysts. Using YARA rules, CAIRN categorizes findings into three levels, ranging from basic AI presence to specific malware families.
Observations on Evolving Threats
The filters have been active since July 2025, originally focusing on identifying language models as optional features in payloads. However, within a year, these models became central to the payload’s operation, leading to the emergence of CLOSEDQUORUM as a notable example. This evolution hints at a broader trend where components of attack chains begin to function autonomously, with implications for both attackers and defenders. Talos researcher Ryan Fetterman emphasized the potential shift in effort dynamics, asserting that as portions of the attack processes become self-operating, defenders have a limited window to adapt to these new challenges.