Malware has started calling the shots. Cisco Talos researchers created a framework that identified a hacking tool able to consult large language models, choose its actions, and operate without any mechanism for human input.
The tool, named CLOSEDQUORUM, is designed to steal login credentials and cryptocurrency. Its autonomous command-and-control infrastructure marks a major shift in how researchers track malicious software, because the code does not simply follow a fixed list of instructions. It can ask AI services what to do next.
CAIRN Finds AI Fingerprints Inside Malware
Cisco Talos created a framework called CAIRN to identify and classify malware that integrates AI. Researchers used CAIRN to identify CLOSEDQUORUM, exposing a system that polls up to four large language models to determine its actions.
Those services include DeepSeek, Qwen, Mistral, and Google Gemini. The malware communicates with Qwen2.5-Coder-32B-Instruct through a Hugging Face API, giving the operation access to a large language model built for code-related tasks.
Ryan Fetterman, a security researcher at Cisco Talos, described the clues that make this type of malware detectable: “The core idea is that AI integration has these vestiges, like fingerprints, that are left behind.”
Those fingerprints matter because AI-powered malware can leave traces that differ from traditional malicious code. CAIRN gives researchers a way to search for and classify those signs, even as developers experiment with new ways to connect malware to open-source AI models and online services.
Fetterman also described how rare named malware families with AI connections had been before this work: “There really wasn’t a lot there. I think I came up with maybe nine different named malware families.”
CLOSEDQUORUM Puts Decision-Making Inside the Attack
CLOSEDQUORUM stands out because its system is totally closed and has no mechanism for human input. Instead of waiting for an operator to send every command, the malware polls AI models and uses their responses to determine its actions.
Its stated targets are clear: login credentials and cryptocurrency. The available facts do not confirm the malware’s developers or its real-world usage, but researchers saw links between the tool and cybercriminal forums focused on credit card fraud dating back to 2025.
That uncertainty does not erase the importance of the design. A tool can be technically capable of autonomous behavior even when its creators and real-world deployment remain unconfirmed. The discovery shows how large language models can become part of malware infrastructure, not just tools for writing code or analyzing threats.
Matt Olney, senior director of threat intelligence at Cisco Talos, captured the change in one sentence: “Initially, everyone saw AI as a productivity tool, right? Now what we’re seeing is that it’s becoming operationalized.”
That operational shift changes the question facing defenders. Instead of asking only whether attackers use AI to build malware, researchers must also ask whether malware itself can use AI during an operation.
On-Chain Malware Activity Surges
The rise of AI-integrated malware arrives alongside a surge in malicious instructions written into on-chain transactions and smart contracts. Those cases increased by 440% in less than a year, moving from an average of two cases per day before mid-2025 to 11 cases per day since mid-2025.
On-chain instructions create another path for malicious activity because the commands can be placed inside transactions and smart contracts. The figures show that this activity is not isolated to a single tool or technique; the volume of recorded cases has expanded across blockchain-related infrastructure.
In July 2025, CERT-UA warned about malware known as LAMEHUG. That warning sits within the same broader period of change, when cybercriminal activity involved both AI systems and blockchain environments.
Together, these developments point to a wider contest over control. Attackers are connecting malware to language models, while malicious instructions are appearing in on-chain transactions and smart contracts. Defenders now need tools that can recognize AI fingerprints, trace model connections, and examine where commands live.
CAIRN offers one response by turning AI integration into something researchers can identify and classify. CLOSEDQUORUM shows why that work matters: when malware can consult models such as DeepSeek, Qwen, Mistral, or Google Gemini, the attack logic no longer sits only in the malware’s original code.
The developers and real-world usage of CLOSEDQUORUM remain unconfirmed, but the direction is visible. AI is moving from a tool used by cybercriminals to a component inside malicious systems, and the next challenge will be finding those systems before autonomous decisions become real-world damage.
Based on
