Cisco Talos finds 'Volta-Autodoxer' infostealer that uses LLMs (defaults to Claude Opus 4.6)
Cisco Talos researchers reported a new strain of infostealer, dubbed Volta-Autodoxer, that compiles harvested credentials and account data into a dossier and queries commercial LLMs via OpenRouter to produce prioritized, analyst-style target assessments. Volta defaults to Anthropic’s Claude Opus 4.6 and has fallbacks to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash; Talos flagged it using its CAIRN framework and did not confirm active use in the wild.