Inside CLOSEDQUORUM: AI-Voting C2, Credential Theft, Discord Exfiltration and Detection Signals
TechNadu · x · 2026-09-23
TechNadu details the mechanics of the CLOSEDQUORUM Windows implant: beyond letting DeepSeek, Qwen, Mistral, and Gemini vote on C2 decisions, it ships credential theft capabilities, Discord-based data exfiltration, and usable detection signals for defenders. No in-the-wild use is confirmed.
Related event: First LLM-as-C2 Malware CLOSEDQUORUM Discovered(2 posts)→
More from Safety
- Spinning up containers for 20-line agent tools is backwards: Safescript compiles provable, 50ms-deploy apps — uriwa · 2026-11-12
- Zvi dissects Anthropic's latest system card, disputing the autonomy threshold call — Don't Worry About the Vase (Zvi) · 2026-11-12
- AI Analysis of 42 Jensen Huang Podcasts Tracks Shift on China and Chip Controls — ShakeelHashim · 2026-11-12
- Small AI sites under 20 MW mostly skip the permitting fights battering big data centers — antavedissian · 2026-11-12
- Newsweek op-ed: US should fund hospitals and universities in federated AI learning — Saul_Loveman · 2026-11-12
- Ron Bodkin: automated research taste advances faster than expected, but the evidence is weak — ronbodkin · 2026-11-11