{"data":{"id":"399b33f1-3a81-45cd-aa4c-1f3d28a5a340","title":"Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer","summary":"The VOLTA infostealer, surfaced by CAIRN research as VOLTA-AUTODOXER, is a self-deleting Windows infostealer that sends a structured evidence bundle on each victim to OpenRouter, using a hardcoded default model (anthropic/claude-opus-4.6) with fallbacks to moonshotai/kimi-k2 and google/gemini-2.5-flash. The model ranks the victim's monetizable assets and assesses their security posture, turning stolen credentials and sessions into a prioritized dossier.","solution":"N/A -- no mitigation discussed in source.","labels":["security","privacy"],"sourceUrl":"https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/","publishedAt":"2026-10-31T12:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI","Anthropic","Google"],"affectedVendorsRaw":["OpenRouter","Claude Opus 4.6","Kimi K2","Gemini 2.5 Flash"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-31T12:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}