VOLTA-AUTODOXER
Latest
VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions
Cisco Talos published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, Discord, Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.
New VOLTA infostealer uses commercial AI models to profile and rank stolen victim data
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests credentials, cookies, session data and cryptocurrency information. It then uses large language models, reported to include Claude, Gemini and Kimi, to enrich identities and rank victims by monetisation value.
New infostealer malware named Volta-Autodoxer uses AI to gather victim data
Volta-Autodoxer is a recently uncovered infostealer that uses AI tools to harvest victim data, including login credentials, credit card numbers, Discord sessions and UberEats receipts. The article is short and gives no detail on distribution, affected versions or attribution.
VOLTA infostealer uses an LLM to rank stolen victim data by monetisation value
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, chat and gaming sessions, OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. It sends a structured evidence bundle to an LLM via OpenRouter, which produces a ranked target assessment, and falls back to other models if one refuses. The malware also uses stolen sessions to enrich the data, for example by searching Gmail for receipts to confirm a home address.