Skip to content
NewA calmer, faster ZeroHour
StoryMalwaremedium

Talos details VOLTA infostealer that ranks victims with commercial LLMs

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cisco Talos describes VOLTA-AUTODOXER, a Windows stealer that optionally asks commercial LLMs to assess stolen victim data; no real-world use is confirmed.

Cisco Talos, through its CAIRN effort, describes VOLTA-AUTODOXER (also written Volta-Autodoxer), a self-deleting Windows infostealer with no attacker-owned infrastructure. After collecting browser credentials, sessions, cards, wallets, tokens, and Wi-Fi passwords, plus Discord, Telegram, Steam, Roblox, Microsoft OAuth, SSH, and cloud keys, it can enrich the haul using the victim’s own accounts and send a dossier to an LLM for a monetization and security-posture assessment. Calls default to OpenRouter’s chat completions API using anthropic/claude-opus-4.6 at temperature 0.2, then fail over to moonshotai/kimi-k2 and google/gemini-2.5-flash if a refusal such as “I can’t” is detected. Talos says the implant still works if the optional AI calls fail and that it has not tracked real-world use. Researcher Ryan Fetterman says clues suggest it may have been built for sale to multiple attackers.

Key facts
  • Self-deleting Windows stealer with no attacker-owned infrastructure.
  • Default model is anthropic/claude-opus-4.6 via OpenRouter at temperature 0.2.
  • Failover models are moonshotai/kimi-k2, then google/gemini-2.5-flash.
  • An embedded cracker targets cryptocurrency vaults and logs cracked results.
  • A 240-word prompt asks for worth and operational-security assessment.
  • Talos says it has not tracked real-world use of the stealer.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Cisco TalosOpenRouter API details, refusal phrases, collection scope, and vault cracker.
  • WIREDNo tracked real-world use, 240-word prompt, and Fetterman’s sale assessment.
Vendors
AnthropicGoogleMoonshot AI
Malware
VOLTAVOLTA-AUTODOXERVolta-Autodoxer
Organizations
Cisco TalosOpenRouterCrowdStrike
AI models
claude-opus-4.6kimi-k2gemini-2.5-flashClaude Opus 4.6Kimi K2Gemini 2.5 Flash

Coverage

oldest first · one row per article · UTC
  1. · 3h ago WIRED · SecurityFirst report

    WIRED: Volta-Autodoxer profiles stolen data with commercial LLMs

    Cisco Talos says it has not tracked real-world use; the stealer still functions if its optional AI calls fail.

  2. · 3h ago Cisco Talos

    VOLTA infostealer uses LLMs to rank victims by monetization value

    The self-deleting Windows stealer posts a structured dossier to OpenRouter and fails over across three models if one refuses.