Cisco Talos analyzes VOLTA infostealer using LLM to rank victim assets

Cisco Talos disclosed a self-deleting Windows infostealer named VOLTA-AUTODOXER that, after stealing credentials, sessions, and crypto wallets, packages the victim's structured information and sends it to an LLM, asking it to rank assets by monetization value and assess their security habits. The trojan by default calls anthropic/claude-opus-4.6 on OpenRouter with temperature set to 0.2, and when a model refuses, it falls back in sequence to moonshotai/kimi-k2 and google/gemini-2.5-flash. Talos also provided mitigation recommendations, including restricting processes that launch Chrome with --headless and preserving the APPDATA%\volta_debug.txt log after compromise.