EN PT-BR
← Voltar ao feed
medium

VOLTA infostealer uses Claude, Kimi and Gemini via OpenRouter to profile victims and rank stolen data

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 02:08 · coletado há 2 horas

Cisco Talos, through its CAIRN research effort, identified a self-deleting Windows infostealer named VOLTA (self-labeled "VOLTA-AUTODOXER") that sends stolen credentials, sessions and crypto data to commercial LLMs via OpenRouter to produce a prioritized victim assessment. The AI layer ranks assets into low, medium or high monetization tiers and assesses the victim's password hygiene and security posture. It does not drive the initial theft. Observed communications rely on third-party services rather than attacker-owned infrastructure, and commercial distribution is not confirmed.

Detalhes técnicos

  • The default model is anthropic/claude-opus-4.6, with fallbacks moonshotai/kimi-k2 and google/gemini-2.5-flash. The malware checks responses for refusal phrases such as "I can't" and "I'm not able", then moves to the next model.
  • Requests use manually assembled JSON, a browser-like User-Agent and a temperature of 0.2. The inference request originates from the compromised host before the dossier is exfiltrated.
  • Collection covers browser passwords, cookies, payment cards, crypto seed phrases, Microsoft OAuth tokens, SSH keys, cloud configurations, Wi-Fi credentials and screenshots. It also covers Discord, Telegram, Steam, Roblox and Slack, and an embedded component attempts to crack wallet vaults.
  • Enrichment reuses stolen sessions: Gmail receipts to corroborate home addresses, Uber Eats and DoorDash order histories, Discord tokens, and Rolimons lookups to value Roblox inventory.
  • Outputs are Identity_Report.txt and AI_Analysis.txt, packaged into volta_dox.zip. volta_log.zip and volta_doxnet.zip support other stages.
  • Six build-time configuration slots suggest a builder model. Customer credentials are encrypted with a key derived from constants in the executable, so they are recoverable through reverse engineering.
  • The App-Bound Encryption bypass path launches Chrome with --headless.

Remediação

  • Monitor for unexpected processes launching Chrome with --headless, and restrict unauthorized headless Chrome execution with application controls.
  • Preserve %APPDATA%\volta_debug.txt, a timestamped log that survives executable deletion and shows whether the AI analysis succeeded.
  • Revoke exposed sessions and tokens, reset passwords, and move assets out of wallets whose seed phrases were compromised.

Linha do tempo

  1. gbhackers.com ↗ · pub. 02/11/2026 02:08 · coletado 02/11 03:00 primeiro registro

    VOLTA infostealer uses Claude, Kimi and Gemini via OpenRouter to profile victims and rank stolen data

    ler a análise desta fonte

    Cisco Talos, through its CAIRN research effort, identified a self-deleting Windows infostealer named VOLTA (self-labeled "VOLTA-AUTODOXER") that sends stolen credentials, sessions and crypto data to commercial LLMs via OpenRouter to produce a prioritized victim assessment. The AI layer ranks assets into low, medium or high monetization tiers and assesses the victim's password hygiene and security posture. It does not drive the initial theft. Observed communications rely on third-party services rather than attacker-owned infrastructure, and commercial distribution is not confirmed.

    Technical Details

    • The default model is anthropic/claude-opus-4.6, with fallbacks moonshotai/kimi-k2 and google/gemini-2.5-flash. The malware checks responses for refusal phrases such as "I can't" and "I'm not able", then moves to the next model.
    • Requests use manually assembled JSON, a browser-like User-Agent and a temperature of 0.2. The inference request originates from the compromised host before the dossier is exfiltrated.
    • Collection covers browser passwords, cookies, payment cards, crypto seed phrases, Microsoft OAuth tokens, SSH keys, cloud configurations, Wi-Fi credentials and screenshots. It also covers Discord, Telegram, Steam, Roblox and Slack, and an embedded component attempts to crack wallet vaults.
    • Enrichment reuses stolen sessions: Gmail receipts to corroborate home addresses, Uber Eats and DoorDash order histories, Discord tokens, and Rolimons lookups to value Roblox inventory.
    • Outputs are Identity_Report.txt and AI_Analysis.txt, packaged into volta_dox.zip. volta_log.zip and volta_doxnet.zip support other stages.
    • Six build-time configuration slots suggest a builder model. Customer credentials are encrypted with a key derived from constants in the executable, so they are recoverable through reverse engineering.
    • The App-Bound Encryption bypass path launches Chrome with --headless.

    Remediation

    • Monitor for unexpected processes launching Chrome with --headless, and restrict unauthorized headless Chrome execution with application controls.
    • Preserve %APPDATA%\volta_debug.txt, a timestamped log that survives executable deletion and shows whether the AI analysis succeeded.
    • Revoke exposed sessions and tokens, reset passwords, and move assets out of wallets whose seed phrases were compromised.