Cisco Talos discloses that the VOLTA trojan uses large models to screen for high-value victims

1. 04:12
   X@BigVikDada· Discussion

   VOLTA-AUTODOXER is a self-deleting Windows infostealer that harvests browser passwords, cookies, payment cards, Discord…(opens the original post in a new tab)
2. 02:47
   WebAI Threat Watch (aithreat.io)· Media coverage

   VOLTA, the infostealer that asks an AI which victims are worth the effort(opens the original post in a new tab)
3. 01:57
   X@T3CHKAT· Discussion

   @infilthE @The_Cyber_News https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-…(opens the original post in a new tab)
4. 01:05
   WebTechRadar· Media coverage

   This new Windows malware steals all your data, then uses AI to rank how valuable you are as a victim(opens the original post in a new tab)
5. 01:05
   WebAI Threat Watch (aithreat.io)· Media coverage

   This new Windows malware steals all your data, then uses AI to rank how valuable you are as a victim(opens the original post in a new tab)

1. 23:17
   X@hkepcmedia· Discussion

   【AI Era ⚠】Cisco's security research team Talos says it has discovered a new type of Windows infostealer trojan named "VOLTA." The most notable feature of this malware is that it overturns the operating model of traditional malware—it does not put large language…(opens the original post in a new tab)
2. 23:16
   WebAI Threat Watch (aithreat.io)· Media coverage

   Malware Volta-Autodoxer: cómo analiza datos con IA(opens the original post in a new tab)
3. 22:47
   Help Net Security AI

   AI-driven infostealer VOLTA-AUTODOXER picks out the most valuable parts of stolen data

   Cisco Talos found a Windows infostealer named VOLTA-AUTODOXER that organizes stolen data into a profile and sends it to a large model, asking it to rank the victim's assets by ease of monetization and label them low, medium or high. The malware first steals browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Microsoft OAuth tokens and SSH keys as usual, then uses the stolen sessions to check Gmail shopping receipts and UberEats and DoorDash orders to fill in information such as home address and employer. Requests are sent by default via OpenRouter to Claude Opus 4.6, and if refusal wording appears in the reply they are forwarded in turn to Kimi K2 and Gemini 2.5 Flash; Talos believes this multi-model design is meant to anticipate refusals. The malware deletes itself after running and connects only to third-party endpoints; its configuration template leaves six slots for the builder to fill in, which researcher Fetterman says suggests it is sold customized to order.

4. 21:46
   CSA Labs Research

   AI valuation: the VOLTA infostealer uses LLMs to grade victims

   CSA research notes interpret Cisco Talos's analysis of the Windows infostealer VOLTA, which after stealing credentials can send the victim's profile to commercial large language models to automatically assess its monetization value and security-habit weaknesses. The malware calls models via OpenRouter, defaulting to Claude Opus 4.6, and upon detecting refusal wording falls back in sequence to Kimi K2 and Gemini 2.5 Flash; the profile contains address, employer, inferred birth year and payment card information, with the address confirmed via receipts in the victim's Gmail. The notes hold that AI has entered the post-theft monetization stage rather than only code generation, potentially letting attackers pick high-value targets from the more than 50 million stolen logs on underground channels in 2025 counted by Flare, and that a single model's refusal cannot stop attackers using aggregators. The notes also state that evidence is limited, that Talos analyzed only a single sample, and that the distribution vector and actual harm are unconfirmed.

5. 21:01
   X@eddyinthebush· Discussion

   VOLTA feeds a model the credentials and wallets it stole, then asks which victim is worth the effort. Ranking is analys…(opens the original post in a new tab)
6. 20:18
   X@The_Cyber_News· Discussion

   ‼ VOLTA Malware Steals Gmail & Discord Sessions, Then Uses AI to Build Detailed Victim Profiles Details: https://cyb…(opens the original post in a new tab)
7. 20:07
   WebAI Threat Watch (aithreat.io)· Media coverage

   Hackers develop new trojan VOLTA, using AI to screen high-value targets for precision attacks(opens the original post in a new tab)
8. 20:00
   WebAI Threat Watch (aithreat.io)· Media coverage

   Hackers develop a new malicious trojan that uses AI to analyze whether a victim is worth attacking(opens the original post in a new tab)
9. 19:53
   WebIThome (China)· Media coverage

   Hackers developed a new malicious trojan, VOLTA, that uses AI to analyze whether a victim is worth intruding into.(opens the original post in a new tab)
10. 19:01
    X@thesystemprompt· Discussion

    Cisco Talos: the VOLTA infostealer sends stolen passwords, wallets and sessions to an LLM via OpenRouter, defaulting to…(opens the original post in a new tab)
11. 18:15
    SSBCrack

    New malware VOLTA-AUTODOXER uses AI to rank stolen data by value

    Cisco Talos researchers disclosed a Windows infostealer named VOLTA-AUTODOXER that calls large language models through OpenRouter to assess and rank stolen victim data by monetization value. The trojan steals browser passwords and cookies, payment card information, crypto wallet seed phrases, Discord, Telegram, Steam and Roblox session tokens, SSH and cloud keys, and compiles victim profiles including home address, employer, last four digits of credit cards and Roblox account valuation, and also searches the victim's Gmail receipts to corroborate the address. The AI analysis prefers Anthropic's Claude Opus 4.6, falling back to Moonshot AI's Kimi K2 or Google's Gemini 2.5 Flash when refused, rotating through at most three models, and uses a 240-word system prompt to have the model act as a forensic intelligence analyst, outputting a list of assets ranked by monetization potential and an assessment of the victim's security posture.

12. 17:59
    WeChatDoonsec· Media coverage

    VOLTA infostealer trojan: steals session credentials, calls large models to automatically generate victim profiles(opens the original post in a new tab)
13. 17:40
    X@arcXonline· Discussion

    Cisco Talos says the malware sends what it stole to an AI model and asks for a section headed "WHAT THEY'RE WORTH". WIR…(opens the original post in a new tab)
14. 17:39
    X@arcXonline· Discussion

    New malware steals your passwords, then asks AI what you're worth. Cisco researchers say it searches your email for re…(opens the original post in a new tab)
15. 17:34
    X@AzrianoY1· Discussion

    Cisco Talos disclosed an infostealer trojan called VOLTA. After stealing accounts, cookies and bank card information, it sends the data to AI and has AI assess how much the victim is "worth." Claude refused, so it switched to Kimi and Gemini and kept asking. What a novice can do is very simple…(opens the original post in a new tab)
16. 17:33
    X@Cyber_O51NT· Discussion

    VOLTA steals and enriches victims’ data, then uses an LLM to rank monetizable assets and assess targets, with fallback…(opens the original post in a new tab)
17. 17:11
    X@CyberWorldOps· Discussion

    Talos: VOLTA stealer uses Claude, Gemini and Kimi AI to rank victims by financial value. https://cyberworldops.eu/en/ta…(opens the original post in a new tab)
18. 16:53
    WebAI Threat Watch (aithreat.io)· Media coverage

    Crean un malware avanzado con IA llamado VOLTA-AUTODOXER(opens the original post in a new tab)
19. 16:07
    WebAI Threat Watch (aithreat.io)· Media coverage

    VOLTA Malware Steals Gmail and Discord Sessions, Then Uses AI to Build Detailed Victim Profiles(opens the original post in a new tab)
20. 15:07
    X@Amu_Lab__· Discussion

    Cisco Talos: Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer https://blog.talosintelligenc…(opens the original post in a new tab)
21. 15:07
    X@Amu_Lab__· Discussion

    An infostealer malware "VOLTA" that uses AI to rank stolen passwords, sessions and keys in order of "how much money they can bring" (Talos report). The sample has Claude Opus 4.6 hardcoded via OpenRouter; when it refuses, it switches to Kimi K2→Gemin…(opens the original post in a new tab)
22. 13:52
    X@TheHackersNews· Discussion

    🚨 New VOLTA infostealer uses Claude, Gemini, and Kimi to rank stolen data by its value to attackers. It steals passwor…(opens the original post in a new tab)
23. 13:51
    The Hacker News

    New VOLTA infostealer uses Claude, Gemini and Kimi to rank victims by economic value

    Cisco Talos disclosed a Windows infostealer named VOLTA (VOLTA-AUTODOXER) that organizes stolen victim data into an evidence package and hands it to large models, which rank it by monetization value and sort it into low, medium and high tiers. The malware calls models through OpenRouter, uses Anthropic's Claude Opus 4.6 by default, and falls back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash when it encounters a refusal, chaining up to three models; its 240-word system prompt asks the model to play a forensic intelligence analyst and output a victim net-worth and OPSEC assessment based only on the evidence package. The theft scope includes browser passwords and cookies, payment cards, crypto wallet seed phrases, sessions such as Discord and Steam, Microsoft OAuth tokens, SSH and cloud provider keys, Wi-Fi configurations and screenshots, and it uses stolen sessions to access Gmail receipts to verify addresses.

24. 13:44
    WebAI Threat Watch (aithreat.io)· Media coverage

    What is Volta-Autodoxer, new AI-enhanced malware profiling victims for hackers in seconds?(opens the original post in a new tab)
25. 13:08
    WebAI Threat Watch (aithreat.io)· Media coverage

    New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data(opens the original post in a new tab)
26. 13:00
    WebAI Threat Watch (aithreat.io)· Media coverage

    VOLTA: El Malware Que Usa IA Para Calcular Cuánto Vales(opens the original post in a new tab)
27. 12:58
    RedditReddit r/AIDangers· Discussion

    New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the AI step entirely News.(opens the original post in a new tab)
28. 08:02
    X@LiamLeeOrg· Discussion

    What is the most devastating cyber humiliation of 2026? It is not that your computer got infected with a trojan. It is that after the trojan stole all your data, it called Claude to calculate your net worth, and in the end the AI advised the hacker: "This guy is too poor, don't waste your time." This is not a joke; it just shot to the top of Hacker News today…(opens the original post in a new tab)
29. Time not given
    Cyber Press

    New AI-driven malware VOLTA steals passwords and cryptocurrency wallets to identify high-value victims

    Cisco Talos discloses the Windows infostealer VOLTA, which steals passwords and cryptocurrency wallets and then uses AI to profile victims and identify high-value targets. The stolen data is passed via OpenRouter to models to generate asset value rankings and assessments of security habits; its AI calls claude-opus-4.6 by default, and can switch to kimi-k2 and gemini-2.5-flash if refused.

30. Time not given
    Cybersecuritynews

    VOLTA malware steals Gmail and Discord sessions, then uses AI to generate victim profiles

    Cisco Talos disclosed a new Windows infostealer, VOLTA: after stealing login sessions for Gmail, Discord and others, it calls AI via OpenRouter to generate an asset valuation report on the victim. The workflow uses Claude Opus 4.6 by default, and when refused, falls back in order to Kimi K2 and Gemini 2.5 Flash; the report rates asset value as low, medium or high and assesses password habits. Talos believes it is sold as a builder, and no attacker-owned server has been found.

31. Time not given
    Security Affairs

    VOLTA infostealer asks AI which victims are worth targeting

    Cisco Talos analyzed a new Windows infostealer named VOLTA (self-named VOLTA-AUTODOXER) that, after stealing data, calls large language models to assess and rank victim value. After running, the malware self-deletes, steals browser passwords, cookies, payment card information, sessions such as Discord and Telegram, and Microsoft OAuth tokens, and must bypass Chrome's App-Bound Encryption. It also uses the victim's session to search Gmail for shopping receipts to confirm the home address, sends the evidence package via the model routing service OpenRouter to large models, and asks for an asset inventory graded by monetization potential and an assessment of the victim's security habits, calling Anthropic's Claude Opus 4.6 by default and, upon detecting a refusal, switching in turn to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash.

32. 05:12
    WebAI Threat Watch (aithreat.io)· Media coverage

    Malware con IA perfila a sus víctimas y calcula qué activos pueden robarse(opens the original post in a new tab)
33. 05:00
    Tom's Hardware

    New AI-driven Windows malware VOLTA-AUTODOXER hands stolen data to Claude, which ranks the victim's assets by value, then deletes itself

    Cisco Talos reported finding a self-deleting Windows infostealer named VOLTA-AUTODOXER that, after stealing data from the victim's computer, by default calls Anthropic's Claude to organize the stolen information into a structured evidence package and has the model list the victim's belongings by monetization value. The malware's prompt instructs the model to act as a forensic intelligence analyst and to answer directly, specifically and accurately; if the model refuses, it can switch to other models or even skip the AI step entirely. Its theft scope includes browser passwords, cookies, saved payment cards, Thunderbird and Outlook mail configurations, Roblox accounts, Microsoft OAuth tokens, screenshots, and SSH and cloud provider configuration files; saved Wi-Fi passwords are obtained in plaintext; for cryptocurrency wallets it does not merely copy them but attempts to crack their vaults directly. It also builds a victim profile, including geolocation and home address, employer and employer domain, inferred birth year, document author metadata and the last four digits of payment cards.

34. 05:00
    WebAI Threat Watch (aithreat.io)· Media coverage

    New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself — payload builds custom target assessment, can switch models if one refuses, or skip the(opens the original post in a new tab)
35. 02:47
    X@AlexNguyen65· Discussion

    A new malware self-named “VOLTA-AUTODOXER” is a self-deleting Windows infostealer that augments its post-theft workflow…(opens the original post in a new tab)

1. 21:21
   WebAI Threat Watch (aithreat.io)· Media coverage

   VOLTA: el malware que usa IA para tasar a sus víctimas(opens the original post in a new tab)
2. 21:04
   WebAI Threat Watch (aithreat.io)· Media coverage

   VOLTA, el malware que roba tus datos y luego pide a una IA que calcule cuánto vales(opens the original post in a new tab)
3. 07:24
   WeChatDoonsec· Media coverage

   AI-driven malware automates doxxing threats—Talos discloses the first infostealer to systematically integrate a large language model, from stealing credentials to automatically generating "target assessment profiles"(opens the original post in a new tab)
4. 07:22
   WeChatWeChat · Wangkong Xianhua Plus· Media coverage

   AI-driven malware automates doxxing threats—Talos discloses the first infostealer to systematically integrate a large language model, from stealing credentials to automatically generating "target assessment profiles"(opens the original post in a new tab)
5. 03:01
   RedditReddit r/Anthropic· Discussion

   Volta, the malware built to ask Claude what each victim is worth(opens the original post in a new tab)
6. 02:47
   maccus.fr

   Volta malware: having Claude assess how much each victim is worth

   Cisco Talos published an analysis on October 31, disclosing a Windows infostealer that calls itself VOLTA-AUTODOXER; after stealing passwords, cookies and cryptocurrency wallets, it sends the victim's profile to commercial AI models, having the models act as forensic intelligence analysts to output asset valuations and assessments of security habits. The default model is Anthropic Claude Opus 4.6 called via OpenRouter, and after detecting refusal phrases it falls back in order to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash. The analysis is based on a single sample first discovered on October 11, with no known attack campaign or victims, and whether the models actually cooperate has not been tested; Talos speculates that the trojan is sold on a builder model, with AI valuation becoming a product feature that lets low-skill buyers also obtain target assessments.

7. 01:43
   WebAI Threat Watch (aithreat.io)· Media coverage

   Malware called Volta-Autodoxer uses AI to build a dossier on its victims(opens the original post in a new tab)
8. 01:29
   X@Python_s_· Discussion

   #NØØT_Security_Alerts 🚨 #ALERT — VOLTA Infostealer Uses AI to Profile Victims and Prioritize Stolen Credentials October…(opens the original post in a new tab)
9. 01:23
   X@shgidi_p· Discussion

   https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/(opens the original post in a new tab)
10. 01:14
    X@Secretof_forest· Discussion

    Cisco Talos details VOLTA, an infostealer that sends stolen victim data to an LLM via OpenRouter for a "target assessme…(opens the original post in a new tab)
11. 01:07
    X@AiquestAcademy· Discussion

    ok attackers are just automating the boring parts of data theft now. Cisco Talos found a new infostealer called Volta-A…(opens the original post in a new tab)
12. 01:05
    X@syndrowm· Discussion

    Hungry hungry hackers > using the victim's own authenticated Gmail tokens, it queries their inbox for receipts from…(opens the original post in a new tab)
13. 00:50
    X@PeterNikolow· Discussion

    "The bundle is serialized and POSTed to OpenRouter under a system prompt that instructs the model to act as "a forensic…(opens the original post in a new tab)
14. 00:47
    X@s_ysaz· Discussion

    Malware that abuses LLMs and evaluates victim value has been confirmed. Companies adopting AI must recognize that AI systems can become a new threat vector, and rebuilding security measures is an urgent task. #AISecurity #CyberAttack #AIRisk https://blo…(opens the original post in a new tab)
15. 00:44
    X@RalGhanmi· Discussion

    https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/(opens the original post in a new tab)
16. 00:41
    X@fanofaliens· Discussion

    https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/ https://blog.talosintelligence.com/ap…(opens the original post in a new tab)
17. 00:41
    X@fanofaliens· Discussion

    holy shit cisco talos just found malware that steals everything off your pc, then sends it to claude and asks for a ful…(opens the original post in a new tab)
18. 00:40
    X@RalGhanmi· Discussion

    https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/(opens the original post in a new tab)
19. 00:32
    X@hackernewstop5· Discussion

    Malware uses LLMs to rank victims by how much they're worth #HackerNews https://blog.talosintelligence.com/appraisal-by…(opens the original post in a new tab)
20. 00:31
    X@techwithjoe_io· Discussion

    Malware is using LLMs to rank victims based on how much they are worth: https://blog.talosintelligence.com/appraisal-b…(opens the original post in a new tab)
21. 00:30
    X@iedaily_· Discussion

    https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/(opens the original post in a new tab)
22. 00:30
    X@iedaily_· Discussion

    Malware asks AI your worth Someone built malware that steals your passwords and then asks an AI how much you're worth.…(opens the original post in a new tab)
23. 00:21
    X@farmeunit· Discussion

    https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/(opens the original post in a new tab)
24. 00:21
    Unite.AI

    Cisco Talos details the stage in which VOLTA infostealer malware uses an LLM to rank victims

    Cisco Talos researcher Ryan Fetterman published an analysis on October 31, 2026, detailing the stage in which the Windows infostealer malware VOLTA-AUTODOXER, after stealing credentials, uses an LLM to rank victims' monetizable assets. The malware extracts multiple types of credentials, including browser, messaging and cloud configurations, and uses stolen Gmail tokens to retrieve receipts corroborating addresses, organizing the evidence into JSON and sending it to OpenRouter's chat completions endpoint. Talos says its default model is anthropic/claude-opus-4.6, falling back in order to moonshotai/kimi-k2 and google/gemini-2.5-flash, with a temperature of 0.2; when a refusal appears in the reply, it switches to the next model, trying at most three. The inference is performed on the victim's endpoint and network connection, and the results are only exfiltrated afterward.

25. 00:21
    Unite.AI

    Cisco Talos describes the victim grading stage in the LLM infostealer VOLTA

    Cisco Talos researcher Ryan Fetterman published an analysis on October 31, 2026 of the Windows infostealer VOLTA-AUTODOXER, malware that after completing a round of credential theft calls an LLM to grade victims by monetization value. In a single run, VOLTA collects credentials and cookies from Chromium, Firefox and Thunderbird, payment cards, session tokens for Slack and Discord and others, SSH and cloud service configurations, Wi-Fi profiles and screenshots, and performs cracking against wallet vaults; it then uses stolen Gmail tokens to search receipts from Amazon, DoorDash, Uber Eats and others to confirm the home address, then checks Uber Eats and DoorDash order history, queries Roblox inventory via Rolimons.com, and compiles everything into Identity_Report.txt and serializes it as JSON.

26. 00:11
    X@jreuben1· Discussion

    Malware uses LLMs to rank victims by how much they're worth https://blog.talosintelligence.com/appraisal-by-ai-model-dr…(opens the original post in a new tab)

1. 23:34
   X@blackorbird· Discussion

   https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/(opens the original post in a new tab)
2. 23:30
   X@BatchukaO· Discussion

   Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims https://www.wired.com/story/kernel-panic-volta-autodoxer-ai…(opens the original post in a new tab)
3. 23:16
   X@techtactician· Discussion

   A new infostealer called Volta-Autodoxer sends what it steals to an AI model, which profiles you for the attacker. Thr…(opens the original post in a new tab)
4. 23:09
   WebAI Threat Watch (aithreat.io)· Media coverage

   Volta malware raids your Gmail receipts, then asks an AI what you’re worth(opens the original post in a new tab)
5. 23:02
   X@kibubble_de· Discussion

   INFOSTEALER: Die Malware Volta-Autodoxer stiehlt Zugangsdaten, Kreditkartennummern, Discord-Sitzungen und sogar UberEat…(opens the original post in a new tab)
6. 22:49
   X@mogeladze1· Discussion

   https://www.wired.com/story/kernel-panic-volta-autodoxer-ai-infostealer-malware/(opens the original post in a new tab)
7. 22:29
   Hacker NewsHacker News· Discussion

   Malware uses LLMs to rank victims by how much they're worth(opens the original post in a new tab)
8. 22:04
   X@thecircuitry_· Discussion

   Researchers uncovered infostealer malware that feeds stolen data into AI models to profile victims and flag high-value…(opens the original post in a new tab)
9. 21:30
   X@digexpl· Discussion

   Spooky New Infostealer Malware Uses AI to ‘Autodox’ Victims https://www.wired.com/story/kernel-panic-volta-autodoxer-ai…(opens the original post in a new tab)
10. 21:19
    X@TwitGri· Discussion

    ⚠ Volta-Autodoxer : Talos analyse un infostealer qui vole mots de passe et jetons puis utilise Claude et d’autres IA p…(opens the original post in a new tab)
11. 21:12
    X@WIREDScience· Discussion

    Named “Volta-Autodoxer,” the recently uncovered malware uses AI tools to collect troves of data about victims, from log…(opens the original post in a new tab)
12. 21:11
    X@haydnsnape· Discussion

    Update: Cisco Talos details VOLTA infostealer that asks Claude, Kimi or Gemini to rank what each victim is worth https…(opens the original post in a new tab)
13. 21:09
    X@willsmithesssss· Discussion

    Cisco Talos found the Volta infostealer feeding stolen logins, cookies and session data to commercial LLMs to auto-buil…(opens the original post in a new tab)
14. 21:09
    X@iCleanAI· Discussion

    Source: Cisco Talos: https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta…(opens the original post in a new tab)
15. 20:52
    X@pragenticAI· Discussion

    A new malware called Volta-Autodoxer uses AI to profile victims by analyzing stolen passwords and tokens. For your team…(opens the original post in a new tab)
16. 20:46
    X@haydnsnape· Discussion

    Cisco Talos finds infostealer malware that sends stolen victim data to Claude, Kimi or Gemini to profile targets https…(opens the original post in a new tab)
17. 20:02
    X@2Workly· Discussion

    VOLTA infostealer bypasses Chrome App-Bound Encryption by spawning headless Chrome to harvest tokens, then runs victim…(opens the original post in a new tab)
18. 20:00
    Cisco Talos

    AI Evaluation: Model-Driven Victim Prioritization in the VOLTA Infostealer Trojan

    Cisco Talos disclosed that the infostealer trojan VOLTA, after stealing credentials, sessions and cryptocurrency wallets, organizes victim data into structured data packages and sends them to large models to rank victims' assets by monetization value. The trojan calls models through OpenRouter, using anthropic/claude-opus-4.6 by default; when refusal expressions such as "I can't" appear in the reply, it switches in turn to kimi-k2 and gemini-2.5-flash, trying at most three models; the temperature is fixed at 0.2. The system prompt asks the model to act as a "forensic intelligence analyst," output a list of asset values labeled low, medium and high, and assess the victim's security habits, then supplement the data with stolen Gmail receipts, UberEats and DoorDash orders, and Discord and Roblox account data. Talos noted that the trojan self-deletes and has no attacker-owned infrastructure; the program reserves six replaceable configuration slots, filled in at compile time, and the authors infer that this is a sell-by-custom-compilation model.

19. 20:00
    WIRED Security and AI

    New infostealer trojan Volta-Autodoxer uses AI to automatically screen high-value victims

    Cisco Talos researchers discovered a new infostealer trojan, Volta-Autodoxer, which organizes stolen credentials into serialized profiles and hands them to a commercial LLM to automatically generate cited victim assessments, so as to quickly identify high-value targets. By default, the trojan calls Anthropic's Claude Opus 4.6 via OpenRouter, and has a preset fallback to Moonshot AI's Kimi K2 when the model refuses, then to Google's Gemini 2.5 Flash; its built-in prompt of about 240 words asks the model to act as a forensic intelligence analyst and produce a victim's "net worth" and opsec assessment. Talos flagged this sample with its newly released CAIRN framework, but did not track whether the trojan has been used in the wild.

20. Time not given
    Martin Cid Magazine

    Malware Volta combs through Gmail receipts, having AI "value" victims

    The malware Volta combs through receipts in Gmail and has AI assess the "value" of victims based on them.

Current attention 58·Peak in the comparable period 70 (Nov 1 02:00)·Change over the comparable past 24 hours 0%