Signals · Hot · first seen October 31, 2026
VOLTA stealer hands stolen data to an AI model to judge what each victim is worth
Cisco Talos researchers have described a self-deleting Windows infostealer that calls itself VOLTA-AUTODOXER, GBHackers reported on Nov. 2. It takes browser passwords, cookies, saved cards, Microsoft sign-in tokens and app sessions such as Gmail and Slack, then can send a summary through OpenRouter to an AI model, trying Claude first and other models if one refuses, to rank what the victim owns. Talos calls the AI step optional; the stealer works without it.
Why it matters to a business like yours
The infection still starts the usual way, with someone on a work computer running a file they should not, and a stolen browser session can open your email and supplier accounts without a password. Check that every work computer runs current security software, and tell staff to install nothing that arrives by email or chat.
Sources
- New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Profile Victims and Rank Stolen Data (GBHackers, November 2, 2026)
On the Insider
History
- November 2, 2026: Hot