Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

Summary

The VOLTA infostealer, surfaced by CAIRN research as VOLTA-AUTODOXER, is a self-deleting Windows infostealer that sends a structured evidence bundle on each victim to OpenRouter, using a hardcoded default model (anthropic/claude-opus-4.6) with fallbacks to moonshotai/kimi-k2 and google/gemini-2.5-flash. The model ranks the victim's monetizable assets and assesses their security posture, turning stolen credentials and sessions into a prioritized dossier.

Related items

• MediumA Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsSame vendor · The Hacker News
• MediumInside a malicious Claude Code-branded extension and its persistent SSH backdoorSame vendor · Microsoft Security Blog
• Medium“Black October” for AI Developer PlatformsSame vendor · Wiz Research Blog
• Infodbreunig/nesformerSame vendor · Simon Willison's Weblog
• MediumCritical Linux kernel flaw allows remote root attacks on MPTCP serversSame vendor · BleepingComputer