New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Summary: Cisco Talos researchers documented VOLTA-AUTODOXER, a Windows infostealer that harvests browser passwords and cookies, Outlook and Slack data, payment cards, crypto seed phrases, OAuth tokens, SSH and cloud keys, and Wi-Fi profiles, then builds a structured evidence bundle on the victim including home address, employer, inferred birth year, and a live Roblox account valuation. The bundle is sent through OpenRouter to Anthropic's Claude Opus 4.6, falling back to Moonshot AI's Kimi K2 and Google's Gemini 2.5 Flash, using a 240-word system prompt that casts the model as a forensic intelligence analyst producing sections titled 'WHAT THEY'RE WORTH' and 'THEIR OPSEC'.
Bottom line: The operator no longer does the triage: any buyer of the builder kit can point VOLTA at victims and receive ranked, citation-backed target assessments in a Telegram inbox, with exfiltration staged over Telegram and settings filled from a six-slot build-time template.

Read the original at The Hacker News ↗

Topics: AI Security
Related: SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026
Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026
186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026