High · 1 source · latest 16h

VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions

AI SECURITYChromeredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Cisco Talos published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, Discord, Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.

For IT people · Written by AI from 1 source · Wrong?

What to do

Block Chrome from starting with the --headless flag unless a known developer process launches it.
Check endpoints for the %APPDATA%\voltadebug.txt log and review outbound connections to the OpenRouter AI endpoint.
If infection is suspected, revoke tokens and reset passwords from a clean device.
Move crypto funds to a new wallet if the seed phrase was stored in plain text.

Written by AI from the sources, checked against them

Read the full story at the source