Infostealer

An infostealer is a type of malware that secretly copies saved passwords, browser session cookies, payment card details, and other sensitive data from an infected computer and sends it to attackers. For compliance and risk teams, the concern is that stolen employee credentials and session tokens can give criminals direct access to corporate systems, cloud accounts, and AI tools without triggering a traditional break-in alert. Because infostealer logs are frequently sold on criminal marketplaces, a single infected laptop can expose an organization's data to many buyers long after the original infection.

1 item

ResearchGlobal2026-11-01

VOLTA Malware Uses Claude and Gemini APIs to Rank Stolen Data by Value

Cisco Talos has documented VOLTA-AUTODOXER, a Windows infostealer. It sends harvested personal data and credentials to commercial frontier model APIs. The malware ranks victims by how profitable they are to exploit. It routes requests through OpenRouter, defaulting to Claude Opus and falling back to Kimi-K2 and Gemini 2.5 Flash when one model refuses. Stolen enterprise AI API keys can be weaponized as analytical infrastructure inside an active attack chain.

VOLTA-AUTODOXER Claude Opus Kimi-K2 Gemini 2.5 Flash Anthropic Google DeepMind Moonshot AI API credential theft model API abuse infostealer