Infostealers
Latest stories covering Infostealers, with summaries and links to related coverage.
1 stories · 1 reports · page 1 of 1
1 story · 1 report in the last 7 days
Latest report · Counts as of (UTC)
Models in this coverage
No tracked models are linked to this topic’s reports in the last 30 days.
No established topics share multiple stories with this topic yet.
Latest stories
Malware uses LLMs to rank victims by how much they're worth
research
7 min read
VOLTA-AUTODOXER is a self-deleting Windows infostealer that uses large language models to turn stolen credentials and personal data into ranked assessments of victims’ monetizable assets. Identified through the CAIRN research effort, the malware steals browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, messaging and gaming sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots. VOLTA further exploits stolen sessions to search Gmail for purchase receipts, retrieve Uber Eats and DoorDash order histories, enrich Discord profiles, and value Roblox inventories. It assembles data including addresses, employers, inferred birth years, Slack workspaces, document metadata, and card last four digits into Identity_Report.txt, then sends it through the victim’s network connection to OpenRouter. Its prompt requests a forensic-style target assessment, including “WHAT THEY’RE WORTH” rankings and an evaluation of the victim’s security practices. The default model is Anthropic’s Claude Opus 4.6, with Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash configured as fallbacks if responses contain refusal language. Results are saved as AI_Analysis.txt and exfiltrated with collected data in volta_dox.zip. The sample was first seen on October 11, 2026, and has a PE timestamp of August 17, 2026.