New infostealer trojan Volta-Autodoxer uses AI to automatically screen high-value victims

Cisco Talos researchers discovered a new infostealer trojan, Volta-Autodoxer, which organizes stolen credentials into serialized profiles and hands them to a commercial LLM to automatically generate cited victim assessments, so as to quickly identify high-value targets. By default, the trojan calls Anthropic's Claude Opus 4.6 via OpenRouter, and has a preset fallback to Moonshot AI's Kimi K2 when the model refuses, then to Google's Gemini 2.5 Flash; its built-in prompt of about 240 words asks the model to act as a forensic intelligence analyst and produce a victim's "net worth" and opsec assessment. Talos flagged this sample with its newly released CAIRN framework, but did not track whether the trojan has been used in the wild.