{"data":{"id":"44e0a841-d6fb-4146-8abf-e5913a2d212c","title":"This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move","summary":"Cisco Talos reported on September 22 a Windows malware named CLOSEDQUORUM that asks up to four commercial AI services (DeepSeek, Qwen, Mistral, and Google Gemini) to vote on its next action instead of taking orders from an attacker's C2 server. The chosen action can be steal, inject, persist, or move, and Talos said the public version's move action has no code and the public build cannot reach the models because it has placeholder API keys and webhook values.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html","publishedAt":"2026-09-23T14:17:58.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain","other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google","Mistral"],"affectedVendorsRaw":["DeepSeek","Qwen","Mistral","Google Gemini","CAIRN"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-23T14:17:58.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"]}}