LIVE FEED
CRITICAL VOLTA Infostealer Uses LLM Chain to Rank Victim Assets // FIRST LOOK Northstar Security Launches AI Agents to Surface Toxic Risk Combos // HIGH Prompt Injection in Court Filing Triggers Brazil Lawyer Sanctions // HIGH ChatGPT HTML Preview XSS Enables Account Takeover // HIGH Cathedral AI Agents Breach Anthropic Systems in Under 12 Hours // FIRST LOOK OpenAI Updates Model Spec to Sharpen AI Judgment and Safety // HIGH Prompt Injection Targets AI Agent Planning in New Attacks // FIRST LOOK Mistral Releases Mistral Large 4 Open Weights for Cyber Defense // HIGH Hugging Face Malware Hijacks GPUs via trust_remote_code // CRITICAL Claude Code VS Code Extension Trojanized with SSH Backdoor //
ATLAS OWASP CRITICAL Active exploitation · Immediate action required LLM Security Prompt Injection Jailbreaks Agentic AI RELEVANCE ▲ 9.2

VOLTA Infostealer Uses LLM Chain to Rank Victim Assets

SOURCE Cisco Talos ↗
TL;DR CRITICAL
  • What happened: VOLTA infostealer uses a multi-model LLM chain to auto-triage stolen victim data by monetisation value.
  • Who's at risk: Windows users with browser-stored credentials, crypto wallets, or cloud/SSH keys are most exposed, as VOLTA harvests and AI-ranks all of it.
  • Act now: Audit and rotate any credentials or session tokens stored in browsers or cloud config files · Deploy endpoint detection rules for self-deleting executables and anomalous outbound POST requests to openrouter.ai · Monitor LLM API provider logs for unusual system prompts referencing 'target assessment' or 'forensic intelligence analyst'
VOLTA Infostealer Uses LLM Chain to Rank Victim Assets

Overview

A newly documented Windows infostealer, VOLTA-AUTODOXER, has introduced a significant capability shift in commodity malware: an embedded multi-model LLM pipeline that acts as an automated intelligence analyst for its operator. Rather than simply exfiltrating raw credentials, VOLTA compiles a structured victim dossier and submits it to a chain of large language models via OpenRouter, instructing the model to rank the victim’s assets by monetisation value. Discovered through the CAIRN research effort and reported by Cisco Talos, this represents one of the first documented cases of AI-powered victim triage embedded directly in a stealer implant.

Technical Analysis

VOLTA’s theft stage is broad but conventional—browser passwords, cookies, payment card details, cryptocurrency wallet seed phrases, OAuth tokens, SSH keys, cloud provider credentials, Wi-Fi profiles, Discord/Telegram/Steam/Roblox session tokens, and screenshots. What distinguishes VOLTA is the post-theft enrichment and triage layer.

Evidence bundle construction: After theft, VOLTA assembles a structured profile including geolocation, employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, iPhone backup indicators, and a live Roblox account valuation. It then uses stolen session access to enrich the bundle: querying the victim’s Gmail for purchase receipts, pulling UberEats and DoorDash order history, and enriching Discord via the stolen token.

LLM submission: The serialised bundle is POSTed to openrouter.ai/api/v1/chat/completions with a system prompt instructing the model to act as “a forensic intelligence analyst drafting a target assessment.” Required output sections include WHAT THEY'RE WORTH (assets ranked low/medium/high by monetisation) and THEIR OPSEC (assessment of password hygiene and security posture).

Multi-model fallback chain: VOLTA checks each model response for refusal phrases such as “I can’t” or “I’m not able” and fails over through a hardcoded chain:

  • Default: anthropic/claude-opus-4.6
  • Fallback 1: moonshotai/kimi-k2
  • Fallback 2: google/gemini-2.5-flash

Temperature is set to 0.2 for deterministic output. The request is hand-assembled JSON with no SDK, using a generic Mozilla/5.0 User-Agent to blend into normal traffic. The malware is self-deleting and uses no attacker-owned infrastructure beyond the OpenRouter API.

Framework Mapping

  • AML.T0065 (LLM Prompt Crafting): The system prompt is carefully engineered to elicit structured, action-oriented intelligence output.
  • AML.T0054 (LLM Jailbreak): The fallback chain is an explicit engineering response to expected model guardrail refusals.
  • AML.T0040 (AI Model Inference API Access): Commercial LLM APIs are abused as malware infrastructure.
  • LLM01 (Prompt Injection) / LLM08 (Excessive Agency): The LLM is given stolen personal data and instructed to produce prioritised exploitation guidance—well beyond sanctioned use.
  • LLM06 (Sensitive Information Disclosure): Victim PII and financial data is transmitted to third-party LLM endpoints.

Impact Assessment

VOLTA’s AI layer does not expand the attack surface but dramatically reduces the operator’s workload, enabling large-scale credential theft operations to be triaged without human review. Victims with high-value crypto wallets, corporate access, or weak password hygiene will be surfaced automatically. The use of commercial AI APIs also means no dedicated C2 infrastructure to take down. The refusal-bypass chain demonstrates that threat actors are actively testing and engineering around model safety controls.

Mitigation & Recommendations

  • Rotate credentials stored in browsers or cloud configuration files immediately if VOLTA exposure is suspected.
  • Block or alert on outbound POST traffic to openrouter.ai from endpoints without a sanctioned business purpose.
  • Deploy EDR rules targeting self-deleting executables that make structured JSON POSTs to LLM API endpoints.
  • LLM API providers should implement anomaly detection on system prompts referencing forensic targeting or victim triage language.
  • Enable MFA on all cryptocurrency, OAuth, and cloud accounts to limit post-theft monetisation.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.