Cisco Talos
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Malware reported by Security AffairsVOLTA infostealer uses an LLM to rank stolen victims by monetisation value
- Malware reported by Help Net SecurityNew Windows infostealer uses AI to rank stolen data by profit potential
- Malware reported by Cyber Security NewsNIK C2 malware abuses OpenAI API for credential theft and remote control
- Vulnerability reported by Zero Day Initiative BlogGitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
- Activity reported by Cisco TalosTalos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
- Zero-day reported by The Hacker NewsVolt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Recent news
VOLTA infostealer uses an LLM to rank stolen victims by monetisation value
Cisco Talos analysed VOLTA, a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, Discord, Telegram and Steam sessions, Microsoft OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. Its LLM stage sends the stolen bundle to OpenRouter, with Anthropic's Claude Opus 4.6 as the default and fallbacks to Moonshot AI's Kimi K2 and Gemini 2.5 Flash if a model refuses. Results are delivered to the attacker via Telegram in zip archives.
New Windows infostealer uses AI to rank stolen data by profit potential
Cisco Talos has identified a new Windows infostealer, VOLTA-AUTODOXER, which sends harvested data to an AI model to rank a victim's assets by potential profit. Cisco security researcher Ryan Fetterman described the approach as casting a wide net and letting AI sort out the specifics.
Trust Onion app uses rotating codewords to verify callers and messages
Trust Onion is a free app for macOS, iOS and Android that lets trusted groups verify each other using three rotating codewords. It also offers signed selfies, message checks and callback requests. The reviewer tested the iPhone app with an older user, and the article notes that Cisco Talos has documented attackers posing as others, though the text is truncated before details.
VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions
Cisco Talos published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, Discord, Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.
VOLTA infostealer uses an LLM to rank stolen victim data by monetisation value
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, chat and gaming sessions, OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. It sends a structured evidence bundle to an LLM via OpenRouter, which produces a ranked target assessment, and falls back to other models if one refuses. The malware also uses stolen sessions to enrich the data, for example by searching Gmail for receipts to confirm a home address.
NIK C2 malware abuses OpenAI API for credential theft and remote control
NIK C2 is a Go-based Windows remote access implant that communicates over TLS WebSockets on port 443 with an HTTP backup channel, using AES-256-GCM encryption and rotating across three server tiers. Its aigenerate command sends attacker prompts to the OpenAI Chat Completions endpoint from the victim's machine, and if no API key is supplied it falls back to the victim's OPENAIAPIKEY environment variable. Cisco Talos, which published its findings, reports credential and crypto-wallet theft, a keylogger, hidden VNC, and a screen-locking ransomware module that does not encrypt files.
GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.
Talos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
Talos IR found phishing was the top initial access method at just over one-third of engagements, down from over 50 percent, with vishing and help desk impersonation used to get victims to allow remote access via legitimate RMM tools. Exploitation of public-facing applications, mainly edge devices, accounted for one-third. Ransomware and pre-ransomware activity reached 27 percent, involving The Gentlemen, Qilin, Rhysida, Interlock and the newer VYPR, with EDR disabled via vulnerable drivers or WDAC.
Volt Typhoon's Silent Train network tied to Cisco SD-WAN zero-day exploitation
Lumen's Black Lotus Labs attributes a covert access network called Silent Train to the China-nexus group Volt Typhoon. It was first identified in late 2023 and was used for zero-day exploitation and strategic access, using rotating chains of compromised SOHO, IoT and enterprise devices. Cisco Talos linked malware that steals keys from Cisco SD-WAN to infrastructure overlapping with this network, which has since been disrupted.