November 2, 2026
- VOLTA-AUTODOXER uses an LLM as its triage analyst, not as a payload. Cisco Talos describes a self-deleting Windows stealer with no attacker-owned infrastructure that, after harvesting browser credentials, cookies, wallet seed phrases, Microsoft OAuth tokens and SSH/cloud keys, uses the victim's own authenticated Gmail and Discord sessions to enrich a dossier (receipts from Amazon, DoorDash, Uber Eats and PayPal corroborate a home address), then POSTs it to OpenRouter under a prompt instructing the model to act as "a forensic intelligence analyst drafting a target assessment." Output includes a "WHAT THEY'RE WORTH" monetization ranking and an OPSEC assessment of the victim. A three-model failover chain handles guardrail refusals (Talos) (discussion). · AI Inside the Intrusion