New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value

Summary

Cisco Talos researchers describe VOLTA-AUTODOXER (aka VOLTA), a new Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, Slack and Outlook data, and Microsoft OAuth tokens. It bundles the stolen data with Gmail receipts and sends it to an LLM through OpenRouter, which ranks the victim's valuables by monetization tier and writes a target dossier. Exfiltration goes over Telegram at three stages.

Related items

• InfoAnthropic reports $17 billion in Q3 revenue, purchase commitments of $895.4 billion in revised S-1Same vendor · CNBC Technology
• InfoCybersecurity M&A Roundup: 37 Deals Announced in October 2026Same vendor · SecurityWeek
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSame vendor · Google Threat Intelligence
• InfoThe U.S. Census Bureau and “Super Intelligence”Same vendor · Simon Willison's Weblog
• InfoStop counting tokens, start counting what shipsSame vendor · MIT Technology Review