CLOSEDQUORUM: When Fleas Hold a Committee Meeting to Decide How to Eat You
I have seen a great many things in my career. I have watched the Flock click on fake grain embedded in fax transmissions. I have watched the Shepherds approve a Sky Pasture migration because someone showed them a colorful brochure. But this. THIS is new.
Cisco Talos has identified a parasite called CLOSEDQUORUM. It does not take orders from a Wolf sitting in a basement somewhere. No. It convenes a panel of up to four artificial intelligence models, holds a vote, and then acts on the democratic consensus of the assembled digital committee.
The fleas are running a faculty senate now. I need a moment.
The models can collectively decide to harvest Windows credentials, scoop up saved browser passwords, and drain crypto wallet data. The Flock, as always, will not notice until the barn is empty and the account balance reads zero.
Now, here is the small mercy Talos is dangling in front of us: the public build does not actually function end-to-end. The researchers have not observed it complete a full operational cycle. It is, at present, an ambitious dissertation with broken footnotes.
Do not let that comfort you. It never comforted me. Back when we ran security on magnetic tape and a dial-up connection that screamed like a wounded animal, we understood that a broken weapon is simply a weapon that needs Tuesday afternoon to become functional.
The real insult here is conceptual. We have now arrived at a world where the parasite does not need a handler. No command-and-control server to block. No Wolf to track. Just four models in a room, voting on your ruin. Modern tools will absolutely fail to account for this because modern tools were built by people who thought the Electric Fence was optional.
I am not well.
Remediation
Practical steps, stated plainly, because I am tired:
Shear your systems. Apply all pending Windows patches immediately. A hole in the fence is a hole in the fence, and this parasite is clearly looking for one.
Audit credential storage. Saved browser passwords are not a security feature. They are a gift basket left on the doorstep for whoever arrives first. Remove them.
Monitor AI-adjacent outbound traffic. Unusual API calls to external model endpoints are your early warning. Log them. Review them. Do not let the Shepherds table that discussion until Q3.
Restrict execution policies. Unknown binaries should not run. This is not a new idea. It is, in fact, an old idea. The old ideas were correct.
The Flock will not read this. They never do.
Stay paranoid, it is the only rational position at this point.
Original Report: https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html