#mistral

September 23, 2026

ClosedQuorum, a Go-based Windows implant, queries DeepSeek, Qwen, Mistral and Google Gemini and lets them vote on its next action from a fixed menu — steal (parallel LSASS dumping, Chrome/Edge/Firefox credential theft, crypto-wallet extraction), inject (shellcode via process hollowing or Early Bird APC), persist, and move, which has no handler in the analysed build. DeepSeek breaks ties, then Qwen, Mistral, Gemini; results go out over a Discord webhook, so everything after delivery runs without an operator. Talos has no confirmation of in-the-wild deployment and the sample carries placeholder API keys, but binary artifacts tie the developer to carding-forum postings dating to 2025 (Cisco Talos, BleepingComputer). · AI in the Attack Chain