Forest Global Training Partners

Cyber Risks · Cisco Talos

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

Summary: Cisco Talos documented a Windows infostealer it calls VOLTA-AUTODOXER that harvests browser passwords, cookies, payment cards, crypto wallet seed phrases, Discord and Telegram sessions, OAuth tokens, SSH and cloud keys, and Wi-Fi profiles, then builds an evidence bundle on the victim and POSTs it to OpenRouter under a prompt casting the model as a forensic intelligence analyst. The returned assessment ranks the victim's assets by monetization tier and rates their password hygiene, with a default model of anthropic/claude-opus-4.6 and a fallback chain to kimi-k2 and gemini-2.5-flash at temperature 0.2.

What's compelling: The operator's own machine runs the inference round-trip through the victim's network before exfiltrating the dossier, and the six swappable build-time slots point to a builder model where any customer receives ranked target assessments in their Telegram inbox.

Read the original at Cisco Talos ↗

Topics
Malware
Related