RESEARCH · RESEARCH · #2899
Cisco Talos finds 'Volta-Autodoxer' infostealer that uses LLMs (defaults to Claude Opus 4.6)
Cisco Talos researchers reported a new strain of infostealer, dubbed Volta-Autodoxer, that compiles harvested credentials and account data into a dossier and queries commercial LLMs via OpenRouter to produce prioritized, analyst-style target assessments. Volta defaults to Anthropic’s Claude Opus 4.6 and has fallbacks to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash; Talos flagged it using its CAIRN framework and did not confirm active use in the wild.
KEY POINTS
- Cisco Talos researchers reported a new strain of infostealer, dubbed Volta-Autodoxer, that compiles harvested credentials and account data into a dossier and queries commercial LLMs via OpenRouter to produce prioritized, analyst-style target assessments.
- Volta defaults to Anthropic’s Claude Opus 4.6 and has fallbacks to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash; Talos flagged it using its CAIRN framework and did not confirm active use in the wild.
- This matters because attackers are augmenting established malware with LLM-driven automated analysis and prioritization, increasing the scale and efficiency of targeted credential theft and profiling.
WHY IT MATTERS
This matters because attackers are augmenting established malware with LLM-driven automated analysis and prioritization, increasing the scale and efficiency of targeted credential theft and profiling.