Understand this story
On October 31, 2026, Cisco Talos disclosed a self-deleting Windows infostealer named VOLTA-AUTODOXER. After stealing credentials, sessions, and cryptocurrency wallets, the trojan packages the victim's structured information and sends it to a large language model, asking it to rank the assets by monetization value and assess the victim's security habits. In an analysis published that day, Cisco Talos researcher Ryan Fetterman noted that the trojan POSTs the collected identity information to OpenRouter, calling anthropic/claude-opus-4.6 by default with a temperature of 0.2, and falling back to moonshotai/kimi-k2 and then google/gemini-2.5-flash when the model refuses to answer. Talos believes the AI layer brings a shift in workload rather than gains in speed or scale, and recommends restricting processes that launch Chrome with the --headless flag, preserving the APPDATA%\volta_debug.txt log after a compromise, and revoking any tokens that may have leaked.
AI-generated from public reports
Latest development · Report
Cisco Talos analyzes VOLTA infostealer using LLM to rank victims' assetsDevelopments
1 confirmed developments
Cisco Talos discloses AI information-stealing malware Volta-Autodoxer
Source:English text is being prepared.
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Nov 1
Unite.AI
Cisco Talos analyzes VOLTA infostealer using LLM to rank victims' assets
Cisco Talos researcher Ryan Fetterman published an analysis of VOLTA-AUTODOXER on October 31; this Windows infostealer, after stealing credentials, calls a large language model to rank the victim's assets into low, medium, and high tiers by monetization value. The malware packages the collected identity information and POSTs it to OpenRouter, using anthropic/claude-opus-4.6 by default, with a fallback chain of moonshotai/kimi-k2 and google/gemini-2.5-flash, a temperature of 0.2, and checks for refusal phrases such as "I can't" before switching models level by level. Talos believes the AI layer brings a shift in workload rather than gains in speed or scale, and recommends restricting Chrome from launching with the headless flag, retaining volta_debug.txt logs, and revoking potentially leaked tokens.
Oct 31
Hacker News Trending
Cisco Talos analyzes VOLTA infostealer using LLM to rank victim assets
Cisco Talos disclosed a self-deleting Windows infostealer named VOLTA-AUTODOXER that, after stealing credentials, sessions, and crypto wallets, packages the victim's structured information and sends it to an LLM, asking it to rank assets by monetization value and assess their security habits. The trojan by default calls anthropic/claude-opus-4.6 on OpenRouter with temperature set to 0.2, and when a model refuses, it falls back in sequence to moonshotai/kimi-k2 and google/gemini-2.5-flash. Talos also provided mitigation recommendations, including restricting processes that launch Chrome with --headless and preserving the APPDATA%\volta_debug.txt log after compromise.
Wired AI
Cisco Talos discovered a new information-stealing malware, Volta-Autodoxer, that uses AI to automatically analyze victims
Cisco Talos researchers discovered a new information-stealing malware, Volta-Autodoxer, which organizes stolen data such as accounts, tokens, payment cards, and crypto wallet seed phrases into profiles, then sends them via OpenRouter to LLMs to generate cited victim assessment reports. The malware calls Anthropic's Claude Opus 4.6 by default and has Moonshot AI Kimi K2 and Google Gemini 2.5 Flash ready as fallback options to handle model refusals; its built-in prompt of about 240 words asks the model to play the role of a forensic intelligence analyst and output an assessment of the victim's "net worth" and "opsec." Talos identified the tool using its CAIRN framework but has not tracked whether it has been used in real attacks.
Heat trend for this story
- Current
- 9
- Period peak
- 26 Nov 1 02:00
- 24-hour change
- -50%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.