Cisco Talos disclosed VOLTA-AUTODOXER, a Windows infostealer that offloads a novel analytical step to large language models: after harvesting Chromium passwords and cookies, Outlook and Slack data, payment cards, cryptocurrency wallet seed phrases, Discord/Telegram/Steam/Roblox sessions, Microsoft OAuth tokens, SSH and cloud keys and more, it builds a structured "evidence bundle" profiling the person behind the machine — geolocation and home address, employer and domain, inferred birth year, card last-four digits, Slack workspaces, document authorship metadata and a live Roblox account valuation — corroborating addresses by mining the victim's Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal. The bundle is serialised and sent through OpenRouter to a default of Anthropic's Claude Opus 4.6, falling back to Moonshot's Kimi K2 and Google's Gemini 2.5 Flash, under a 240-word "forensic intelligence analyst" system prompt that forbids the model from using outside facts. The output ranks the victim's valuables — "WHAT THEY'RE WORTH" — by monetisation tier and assesses their operations security, giving operators automated victim prioritisation.

• Source article