Cisco Talos finds VOLTA infostealer using Claude to rank victims by their asset value

Hesamation · x · 2026-11-02

Cisco Talos披露 VOLTA-AUTODOXER, a self-deleting Windows infostealer that embeds an LLM as an "intelligence analyst" in its post-theft workflow.

• Steals browser passwords, cookies, payment cards, crypto seed phrases, Discord/Telegram/Steam/Roblox sessions, Microsoft OAuth tokens, SSH/cloud keys, Wi-Fi profiles
• Builds a structured victim profile: geolocation and home address, employer, inferred birth year, card last-4, Slack workspaces, document metadata, iPhone backup indicators; enriches it by searching Gmail for Amazon/DoorDash receipts
• Uses Claude Opus 4.6 to appraise the victim's monetization value and rank assets; on refusal it fails over to a three-model chain, anticipating guardrails
• Self-deleting, no attacker infrastructure — a new "steal everything, let AI sort it out" cybercrime model

Related event: Cisco uncovers VOLTA stealer that uses LLMs to value stolen data and swap models to dodge guardrails(2 posts)→

Original post →

More from Models

• EU ordered Meta to restore free WhatsApp access for rival AI assistants — SumitGup · 2026-11-02
• DeepSeek V4.1 Flash EXL3 2.81bpw quant lands with 57tps decode, 60-90% speedups — HankYeomans · 2026-11-02
• Leak: Gemini 4 Argon excels at scanning large codebases, Carbon may be outdated at launch — haider1 · 2026-11-02
• Reddit debate: are 300 tok/s local LLM speed posts meaningless without KLD quality benchmarks? — PathfinderTactician · 2026-11-02
• Speculation: a product may have quietly switched to Opus 5.5 at below-API rates — brandon_galang · 2026-11-02
• Reddit user claims Claude Opus 5.5 secretly dumbed down, self-reported effort at 15 — Training-Flan8762 · 2026-11-02

Models channel →