Cisco Talos finds malware using Claude, Kimi and Gemini to analyze stolen data
A new infostealer called Volta-Autodoxer sends stolen victim data through commercial language models via the service OpenRouter and asks them to produce structured, prioritized victim dossiers – with built-in failover to more permissive models if guardrails refuse. The findings from Cisco Talos were shared exclusively with WIRED and have not previously been reported, and Talos has not yet traced whether the malware has actually been used in real-world attacks.
What is new
Researchers at Cisco Talos have identified a new infostealer strain that has been named Volta-Autodoxer. According to WIRED's reporting, shared exclusively with the company's Kernel Panic newsletter, the finding marks a shift in how AI fits into cybercrime: language models are no longer just a topic in criminal discussion forums, but operationalized inside the malware itself.
Volta belongs to an established malware type – infostealers that steal login credentials and payment information from infected machines. The new part is an added layer: once the data has been collected, it is sent through commercial LLMs that automatically profile the victim and flag the most valuable targets. It was CAIRN, a framework Talos built to identify hacking tools with built-in AI features, that flagged the malware, according to WIRED.
How it works
The first step is conventional. According to WIRED's account of the Talos findings, Volta sweeps up passwords stored in browsers, Microsoft OAuth tokens, cookies, payment cards, and seed phrases from cryptocurrency wallets. The malware also collects active sessions in Discord, Telegram, Steam, and Roblox.
The second step is the new one. All of the data is assembled into a serialized dossier that is sent to language models.
"It assembles all of this, and eventually produces a serialized dossier that it can send to a couple of LLM models. It asks the model to act as an intelligence analyst and produce a structured, source-backed assessment of the victim. It's kind of a prioritization and analysis function," says Ryan Fetterman, security researcher at Cisco Talos, according to WIRED.
The prompt: "You are a forensic intelligence analyst"
Inside the malware sits a 240-word prompt that documents what the attackers want out of the model. It opens with the words "You are a forensic intelligence analyst drafting a target assessment from a structured evidence bundle," according to WIRED's account.
The prompt instructs the model to produce an executive summary about the person, details of what the person is involved in, an assessment of "what they're worth," and a summary of "their opsec" – that is, the victim's own security practices. In other words: not just stolen raw data, but a finished, prioritized, analyzed picture of the victim. The source does not explicitly state what the dossiers are to be used for.
The model chain and the failover design
According to WIRED's reporting on the Talos findings, Volta sends its requests via OpenRouter, an intermediary service that routes calls to many different LLM providers. The default model is Claude Opus 4.6 from Anthropic. But the developers behind the malware appear to have anticipated that guardrails could block the request: a fallback to Kimi K2, a Chinese open-weights model from Moonshot AI, is built in, and if that also fails, to Google's Gemini 2.5 Flash.
Fetterman describes the design choice this way, as rendered by WIRED:
"They build in the expectation that they can potentially hit model refusal at the first request. So they plan for failover that cascades down to more permissive models as they go down the chain. It's also possible to use the implant without the AI. The AI calls are an add-on beyond the usual, but the malware still works without it."
That last point is important for understanding the finding: the AI component is optional. The theft of passwords, tokens, and card data happens regardless. The LLM layer is an efficiency mechanism – a way of letting a model do the analyst work that would otherwise require humans with time and expertise.
What we don't know
Several significant questions remain open, and they should be weighed when reading the finding.
First, Talos has not traced whether Volta has actually been used in the wild, Fetterman points out to WIRED. There is no information about victims, attacks, or active campaigns – the finding is based on analysis of malware samples.
Second, all technical details – the model names and versions, the prompt, the failover chain – come from Talos's analysis as WIRED reports it. Talos's own report is not available, and the details have therefore not been independently verified by others. Models are updated quickly, and it is unclear whether the chain described in the malware still works that way.
Third, the timing is unclear: the research was published via Kernel Panic on October 31, 2026, but there is no independent date for when Talos made the discovery itself.
Why it matters
The central point of the finding is not that AI enables a new attack method – it does not do so here. Volta is a classic infostealer with an analytical add-on layer. It points toward something more concrete: language models being deployed as analysis and prioritization engines inside established malware types, where the bottleneck has traditionally been human work sorting and quality-assessing stolen data.
At the same time, the design shows that the attackers expect resistance: the failover chain is built in from the start, in recognition that the major models will likely refuse. That is also why CAIRN was built – Talos developed the framework to catch tools with this kind of AI functionality, and Volta is an example of it catching such a find. How widespread such tools become, and whether Volta was ever used against real victims, remain open questions.
Source: WIRED