Stealers used to dump your passwords and move on. VOLTA reads the dump first. … · @harden_369741 · TwKit

@harden_369741

Stealers used to dump your passwords and move on. VOLTA reads the dump first. Cisco Talos found VOLTA-AUTODOXER, a Windows infostealer with the usual haul: browser passwords, cookies, saved cards, wallet seeds, Discord and Steam sessions. Then it bundles it all into a dossier and sends it through OpenRouter to an LLM, default Claude Opus 4.6, asking for a forensic target assessment. The model ranks what you are worth, low, medium, high, and grades your password hygiene. If one model refuses, the code looks for refusal phrases and falls back to Kimi K2, then Gemini 2.5 Flash. That fallback chain is the tell. The builder expected refusals and engineered around them. Talos has not seen it in the wild yet, and the AI step is optional. I still think the design matters more than the deployment count. Theft now gets triaged like a sales pipeline. The attacker no longer reads your life, the model hands back a priority list. My read: rotating passwords after a stealer hit was never enough. Revoke sessions and OAuth tokens first, then rotate passwords. Assume anything in that browser profile was read by something that writes citations. Source: Cisco Talos, Oct 31 https://blog.talosintelligence.com/appraisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/ #AISecurity #Malware

曝光 13 · 评论 0 · 点赞 0 · 书签 0