VOLTA-AUTODOXER / VOLTA: Windows infostealer uses Claude, Gemini, Kimi LLMs to rank victims by financial value (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-11-02
Cisco Talos disclosed a new Windows infostealer, VOLTA-AUTODOXER (VOLTA), which harvests browser passwords, cookies, payment cards, crypto seed phrases, session tokens, SSH/cloud keys, and screenshots, then builds a structured evidence bundle about the victim (address, employer, card digits, Roblox valuation). The bundle is sent via OpenRouter to Claude Opus 4.6, falling back to Kimi K2 and Gemini 2.5 Flash, which produce a monetization-ranked dossier including a 'WHAT THEY'RE WORTH' tier list and victim OPSEC assessment. Data is exfiltrated over Telegram in three stages. A six-slot build template suggests a malware-as-a-service builder kit. Talos also detailed NIK C2, a Go-based RAT that LLMjacks the victim's own OPENAIAPIKEY for AI analysis. No CVE; no vendor patch applies—defence is endpoint hygiene and credential protection.
What to do
- Enforce MFA and rotate credentials on Windows endpoints; monitor for anomalous browser/credential access
- Block or monitor egress to Telegram bot APIs and OpenRouter/LLM API endpoints from endpoints
- Hunt for OPENAI_API_KEY exposure in environment variables and rotate any leaked keys (LLMjacking risk)
- Keep browsers, OS, and EDR updated; restrict stored payment cards and crypto wallet material on workstations
- Monitor for infostealer IOCs and review Slack/Discord/Steam/Roblox session tokens for abuse
Sources
All live incidents on Threat Watch
