Cisco Talos found a new Windows infostealer called VOLTA (also VOLTA-AUTODOXER). It steals the usual stuff, then has an AI model rank each victim by how much money they’re worth.
How it works
- It grabs browser passwords and cookies, Outlook data, payment cards, crypto seed phrases, Discord, Telegram and Steam sessions, Microsoft OAuth tokens, SSH and cloud keys, Wi-Fi profiles and screenshots.
- It builds a profile: location, home address, employer, birth year and more. It even searches the victim’s Gmail for Amazon and DoorDash receipts to confirm the address.
- Then it sends the bundle through OpenRouter to Anthropic’s Claude Opus 4.6 by default. If Claude refuses, it falls back to Moonshot AI’s Kimi K2, then Google’s Gemini 2.5 Flash. It checks replies for phrases like “I can’t” to spot refusals.
My take
Model refusals help, but a fallback chain gets around them. The real defense is still the basics: don’t run random downloads, use a password manager and hardware keys, and keep SSH and cloud keys off machines that don’t need them.
God Bless, and May the Source Be with You!
