Latest
  1. Ireland’s government will not oppose Labour bill on AI sexual abuse images
  2. METR estimates Anthropic’s capabilities now improve at about twice its 2024 to 2025 pace
  3. Anthropic rolls out Personal Finance beta in Claude, with read-only bank access
  4. Baidu releases ERNIE-5.5-Flash-Base pre-training checkpoint on Hugging Face
  5. Parents sue Google, saying Gemini on a school Chromebook helped their daughter plan suicide
  6. Visa benchmark finds AI shopping agents fail 42.8% of runs
  7. OpenAI releases GPT-6 Cyber for approved security customers
  8. Google releases Gemini Omni 1.2 Flash with 15-second video clips

Latest / Finance

IncidentFinanceMediaFrontierChinaConfirmed

Volta-Autodoxer infostealer uses AI models to profile and rank victims

See how this story connects

Source: Cisco TalosAlso reported by Wired

Cisco Talos researchers found an infostealer called Volta-Autodoxer that sends stolen victim data to large language models for analysis. The malware collects browser passwords, Microsoft OAuth tokens, cookies, payment cards and crypto wallet seed phrases, then builds a dossier on the victim and sends it to a large language model through OpenRouter. Requests default to Anthropic’s Claude Opus 4.6, with fallbacks to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash, and the prompt tells the model to act as a forensic intelligence analyst. Talos flagged the malware using its CAIRN framework, which identifies hacking tools with AI capabilities, and did not track whether Volta has been used in the wild.

Why it matters

Cisco Talos researcher Ryan Fetterman says identifying high-value targets faster gives attackers a better chance of using stolen credentials and tokens before tokens expire or passwords are changed.

When
31 Oct 2026
ID
WTA-N-2026-0587
Where
China
Who
Cisco Talos, Anthropic, Moonshot AI, Google, OpenRouter; Ryan Fetterman
System
Volta-Autodoxer infostealer sending victim dossiers to Claude Opus 4.6 (fallbacks Kimi K2, Gemini 2.5 Flash) through OpenRouter
Operator
Unknown (Cisco Talos did not track use in the wild)
Type
credential theft (passwords, OAuth tokens, cookies, payment cards, wallet seed phrases) with AI-ranked victim profiles
Status
disclosed 31 Oct 2026; disclosed by Cisco Talos · Incident ledger

Summary written with AI by wheresthe.ai, from Cisco Talos and the reporting credited above. Checked against the source on 31 Oct 2026.

Read the original at Cisco Talos

Source copy: saved on 31 Oct 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.

Next stop on this Storyline: What happened nextGovernment Linux servers targeted with SysGoRAT and suspected AI-generated scripts

Cite this story

WTA-N-2026-0587: “Volta-Autodoxer infostealer uses AI models to profile and rank victims.” wheresthe.ai, 31 Oct 2026. https://wheresthe.ai/d/cn-volta-autodoxer-infostealer-uses-ai-models-to-profile-and-2026-10/ (source: Cisco Talos).

Spotted an error? Email [email protected].