{"data":{"id":"26ca98fc-9d7c-43f0-beb9-0ab4c232ee0c","title":"New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value","summary":"Cisco Talos researchers describe VOLTA-AUTODOXER (aka VOLTA), a new Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, Slack and Outlook data, and Microsoft OAuth tokens. It bundles the stolen data with Gmail receipts and sends it to an LLM through OpenRouter, which ranks the victim's valuables by monetization tier and writes a target dossier. Exfiltration goes over Telegram at three stages.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://thehackernews.com/2026/11/new-volta-infostealer-uses-claude.html","publishedAt":"2026-11-02T05:51:07.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["pii_leakage"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic","Google"],"affectedVendorsRaw":["Claude Opus 4.6","Gemini 2.5 Flash","Kimi K2","OpenRouter"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-02T05:51:07.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}