Gemini 2.5 Flash
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Malware reported by Security AffairsVOLTA infostealer uses an LLM to rank stolen victims by monetisation value
Recent news
VOLTA infostealer uses an LLM to rank stolen victims by monetisation value
Cisco Talos analysed VOLTA, a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, Discord, Telegram and Steam sessions, Microsoft OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. Its LLM stage sends the stolen bundle to OpenRouter, with Anthropic's Claude Opus 4.6 as the default and fallbacks to Moonshot AI's Kimi K2 and Gemini 2.5 Flash if a model refuses. Results are delivered to the attacker via Telegram in zip archives.
VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions
Cisco Talos published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, Discord, Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.