Skip to content
Moojaz — موجز
Search
Menu
HomeRegionsMaghrebAfricaMiddle EastEuropeAsiaAmericasWorldSectionsPoliticsEconomySecurityHealthScienceTechnologyAIEnvironmentCultureSportsSearch
Reported information

Talos describes VOLTA malware configured to have AI appraise stolen data

Cisco Talos published an analysis on 31 October 2026 of VOLTA-AUTODOXER, Windows malware configured to rank a victim’s assets by monetisation value using stolen data. The report describes a sample; no campaign or victim count has been established.

Padlock over blue circuits.
Cybersecurity illustration from 2018; it does not depict VOLTA malware. — jaydeep_ / Pixabay / Wikimedia Commons — CC0 1.0 https://creativecommons.org/publicdomain/zero/1.0/ — illustration de 2018, sans modification.

Researchers say the program collects credentials, sessions and cryptocurrency wallet data, then builds a profile enriched with receipts and order histories. It can send that bundle to a model through OpenRouter for assessment.

Its configuration prioritises Claude Opus 4.6, with Kimi K2 and then Gemini 2.5 Flash as fallbacks after refusals. This describes what the code is set up to do, rather than proving the models accepted requests. Without an API key, theft can continue without the AI step. Talos recommends revoking potentially compromised tokens and changing passwords.

Sources 4