VOLTA‑AUTODOXER Infostealer Uses LLMs to Rank Victims by Financial Value
What Happened — Researchers disclosed a new Windows‑only infostealer dubbed VOLTA‑AUTODOXER (or simply VOLTA). The malware harvests credentials, browser cookies, Outlook data, and Slack tokens, then feeds the collected artifacts to a large‑language model (LLM) such as Claude, Gemini, or Kimi. The LLM evaluates the data and assigns a monetary “value score,” allowing the operators to prioritize high‑value victims for resale or extortion. The campaign was first observed in early November 2026 and is being distributed via malicious email attachments and compromised software installers.
Why It Matters for Trust & Control Assurance — The LLM‑driven ranking amplifies the impact of credential theft, making robust identity‑and‑access controls and continuous monitoring essential to limit exposure.
Who Is Affected — Any organization with Windows workstations that store corporate credentials or collaboration data, notably technology, professional services, and finance sectors.
Recommended Actions
- Enforce multi‑factor authentication (MFA) for all privileged and remote access accounts.
- Deploy endpoint detection and response (EDR) capable of blocking credential‑dumping tools.
- Rotate passwords regularly and store them in a managed password vault.
- Conduct security‑awareness training focused on phishing and malicious downloads.
- Implement continuous monitoring of credential‑use anomalies and generate audit‑ready logs.
Technical Notes —
- Attack vector: Malware delivered via phishing attachments and compromised installers.
- LLM usage: Claude, Gemini, and Kimi APIs are called locally to score stolen data.
- Data types exfiltrated: Browser passwords/cookies, Outlook PST files, Slack tokens, and other personal identifiers.