VOLTA infostealer uses an LLM to rank stolen victim data by monetisation value
AI SECURITYCisco Talosredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Cisco Talos describes VOLTA (VOLTA-AUTODOXER), a self-deleting Windows infostealer with an optional LLM triage stage that POSTs a victim evidence bundle to the OpenRouter API. The default model is anthropic/claude-opus-4.6 at temperature 0.2, with a failover chain of moonshotai/kimi-k2 and then google/gemini-2.5-flash when refusal phrases are detected. The stealer enriches data with live session access, including Gmail receipt searches, Uber Eats and DoorDash order history, Discord token reuse, and Rolimons valuation of Roblox inventory. The articles give no CVEs and no specific defensive guidance.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cisco Talos
Who and what is in it
Malware
Companies