Discord
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Malware reported by Wired (Security)New infostealer malware named Volta-Autodoxer uses AI to gather victim data
- Activity reported by Cyber Security NewsDeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages
- Malware reported by Cyber Security NewsNIK C2 malware abuses OpenAI API for credential theft and remote control
Recent news
VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions
Cisco Talos published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, Discord, Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.
New infostealer malware named Volta-Autodoxer uses AI to gather victim data
Volta-Autodoxer is a recently uncovered infostealer that uses AI tools to harvest victim data, including login credentials, credit card numbers, Discord sessions and UberEats receipts. The article is short and gives no detail on distribution, affected versions or attribution.
VOLTA infostealer uses an LLM to rank stolen victim data by monetisation value
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, chat and gaming sessions, OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. It sends a structured evidence bundle to an LLM via OpenRouter, which produces a ranked target assessment, and falls back to other models if one refuses. The malware also uses stolen sessions to enrich the data, for example by searching Gmail for receipts to confirm a home address.
DeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages
ESET reports that DeceptiveDevelopment, a North Korea-aligned group, used stolen Git credentials, SSH keys and tokens between April and September 2026 to alter public and private repositories, often rewriting commit history. Poisoned code appeared on npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces, and the group deployed the OmniStealer infostealer and the DEVPOPPER remote access trojan.
NIK C2 malware abuses OpenAI API for credential theft and remote control
NIK C2 is a Go-based Windows remote access implant that communicates over TLS WebSockets on port 443 with an HTTP backup channel, using AES-256-GCM encryption and rotating across three server tiers. Its aigenerate command sends attacker prompts to the OpenAI Chat Completions endpoint from the victim's machine, and if no API key is supplied it falls back to the victim's OPENAIAPIKEY environment variable. Cisco Talos, which published its findings, reports credential and crypto-wallet theft, a keylogger, hidden VNC, and a screen-locking ransomware module that does not encrypt files.