Vulnerability / research

VOLTA infostealer can use language models to rank stolen information

Reported

Published here

What happened

Talos analyzed a Windows infostealer with an optional model call that turns harvested credentials, session data and wallet information into a target assessment. The binary can switch providers if a model declines the request.

Parties and reporting

AI tools and systems: VOLTA-AUTODOXER, OpenRouter, Claude Opus 4.6, Kimi K2 and Gemini 2.5 Flash (configured sequence)

Outcome

Talos documented the sample’s collection and transfer paths. The stealer can collect information even if model analysis fails. The report does not establish a victim count, a completed model call against a particular victim or losses.

Operating lesson

Look for unexpected headless Chrome launches, preserve the stealer’s local harvest log and revoke tokens found on affected endpoints.

Evidence and limits

This is analysis of a malware sample, not a count of confirmed infections. Talos infers an apparent builder model from the configurable binary. Commercial sale and which configured model returned an assessment remain unverified.

Sources