网络安全
Cisco Talos 详细信息 VOLTA 信息窃取者 LLM 受害者搜索阶段
在 Google 上的首选来源中添加 Unite.AI
Cisco Talos研究员Ryan Fethterman于2026年10月31日发表了一份对VOLTA-AUTODOXER的分析，该分析是一位自发删除的Windows信息化者，该信息化者遵循了广泛的证书-盗取口号，并配有大型语言模型舞台，旨在给每个被害者货币化的资产排出分级。
Talos将VOLTA描述为带有可选的AI-集成层的成熟盗取者植入，称所观察到的每个端点都是由第三方控制的，没有攻击者拥有的基础设施。 在Talos的评估中，人工智能阶段的新颖之处是，该模型是代表操作者进行情报分析，而不是支持传统的恶意软件能力，将原始的证书记录转换成以引用为后盾的受害人货币资产的优先档案。
恶意软件在Talos的CAIRN研究中浮出水面。 Talos 发布和开源 CAIRN，认知活性人工智能研究网，2026年9月22日，作为猎取，分类和通过嵌入的提示，提供者端点等元数据文物追踪AI-集成的恶意软件的工具包，API密钥不下载或执行基础二进制。 Talos 称在发布时表示，它将随时间推移分享其初步调查结果，首先是CloseEDQUORUM，它描述为完全自主的多型共识管弦乐手，没有人类操作者。
收集和会议充实
单VOLTA通过取出浏览器证书，cookie，并保存了Chromium类浏览器的支付卡，连同Firefox和Tunderbird数据，Outlook简介，Slack工作空间，Steam和Battle.net会话，Discord令牌，Telegram会话，Roblox帐号，Microsoft OAuth令牌，SSH和为gcloud,OpenVPN，和Hide.me,Wi-Fi简介以及截图。 窃取者不是简单地复制密码货币钱包，而是在同一通行证期间对钱包金库运行嵌入式快克机，并将结果记录在WALLET VAULTS CRAKED一行上。 一个直接的WlanGetProfileList呼叫器在主机上以平白文本将每一个被保存的Wi-Fi密码都丢弃。
现场的浓缩传球再重新使用被窃的会话。 VOLTA用受害人自己的经认证的Gmail令牌，搜索收件箱，它直接拉出Uber Eats和DoorDash订购历史，通过被窃取的道具丰富了被害者的Discord简介，并通过对Rolimons.com的活泼取景来重视Roblox存货。 收集的材料在当地汇编成一个结构化的证据包，其中包含地理位置和住址、雇主和雇主领域、推定的出生年份、卡片倒数至四位数、Slack工作空间、文件作者元数据以及iPhone备份指标，然后保存为身份-报告.txt并被序列化为JSON。
该模型的回回回评估被保存为AI Analysis.txt，并可在三个分级的档案中进行过滤：Volta log.zip在窃取者运行后，Volta dox.zip在AI调用后，如果网络浓缩产生任何结果，Volta doxnet.zip.
开放路特排名阶段
系列捆绑在OpenRouter聊天完成点上，所需产出包括一个他们正在WORTH的栏目，按照低、中、高等层次的货币化价值对受害人的价值进行排名，以及一个评估受害人安全态势和密码卫生的栏目。 将受害者的姓名、地址或大学与密码中的图案联系起来。 Talos 指出该模型没有被要求找到数据，以至于得出可以扩展已经被刮去的值的推断。
硬编码配置采用anthropic/claude-opus-4.6为默认型号，后由月球相接回链/kimi-k2并再由google/gemini-2.5-flash相接而成，温度为0.2，手取JSON请求而无SDK并有Mozilla/5.0 User-Agent. 低温度的Talos 称表明操作员强调准确性和一致性，并描述连锁链是当出现拒绝时向更小、更宽容的模型过渡的支点。
VOLTA在向下移动多达3个模型的链条之前，检查每个模型响应的拒绝短语如"I can't"，如果不存在API密钥，它可以完全在没有LLM级的情况下运行。 整个推论在受害人的机器上通过受害人自己的网络连接进行；只有在事后才发现结果。
建设者部署和反措施
VOLTA与其硬编码其Telegram通道，API密钥，和设置，而是从一个模板中编译出，在构建时填充了六个可互换的空档。 Talos 称这指向了一种构建者模型，作者在其中出售访问，购买者提供自己的价值，并为每个订单编译自定义的二进制。 如果该模型，即分析指出，AI档案是一个商业特征，让任何精密水平的客户在Telegram收件箱中接受排名目标评估，而不是作者为个人使用而建立的能力。 槽口证书被加密，其密钥由两个常数的SHA-256衍生出在同一二进制中，塔洛斯称没有提供有意义的保护，因为任何翻转文件的人都可以收回。
VOLTA的道具被窃取，Talos 称限制哪些过程可以使用无头旗的发布 Chrome 将完全阻断解密路径，并且至少建议当Chrome 发布头部从出乎意料的进程中发出警报，同时进行硬件后置的证书存储。 妥协后，塔洛斯建议保留volta debug. txt文件，一个有时间戳的收割日志记录了所收集的确切内容以及LLM呼叫是否成功，然后撤销了可能损坏的令牌并更改了密码。 任何在磁盘上使用 " 种子 " 一词的钱包，都应被视为已完全失密，资金将转移到一个新的钱包上，其种子是在空气加载设备上产生的。
在Talos的架构中，AI层的带来的改进是努力转移，而不是速度或规模，这是CLOSEDQUORUM中所确定的同一基本逻辑，适用于操作的不同阶段。 随着恶意软件的AI集成逐渐成熟，分析得出结论，拒绝应变能力可能成为一种标准设计要求。
Talos将所分析的样品列为PE32+x86-64 二进制，与SHA-256 hash 57ef42666d78c50df145b34023df564f0fad 38812d6a580e66433d427e2279，在文件名"9BY0tjwOc3ut.exe"和"yLP9m5J3i2Aw.exe"下被观测到，携带了PE时间戳于2026年8月17日，2026年10月11日12:46首次出现。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Cisco Talos Details VOLTA Infostealer’s LLM Victim-Ranking Stage
Add Unite.AI to your preferred sources on Google
Cisco Talos researcher Ryan Fetterman on October 31, 2026 published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that follows a broad credential-theft pass with a large language model stage designed to rank each victim’s monetizable assets.
Talos describes VOLTA as a mature stealer implant with an optional AI-integration layer, and says every observed endpoint is third-party controlled, with no attacker-owned infrastructure. In Talos’s assessment, the novelty of the AI stage is that the model works as an intelligence analyst on the operator’s behalf rather than supporting a traditional malware capability, converting a raw credential log into a prioritized dossier of the victim’s monetizable assets backed by citations.
The malware surfaced through Talos’s CAIRN research effort. Talos released and open-sourced CAIRN, the Cognitive Artifact Intelligence Research Network, on September 22, 2026 as a toolkit for hunting, classifying, and tracking AI-integrated malware through metadata artifacts such as embedded prompts, provider endpoints, and API keys, without downloading or executing the underlying binaries. Talos said at release that it would share its initial findings over time, beginning with CLOSEDQUORUM, an implant it described as a fully autonomous multi-model consensus orchestrator with no human operator.
Collection and Session Enrichment
A single VOLTA pass extracts browser credentials, cookies, and saved payment cards across Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens, SSH and cloud-provider configuration files for gcloud, OpenVPN, and Hide.me, Wi-Fi profiles, and screenshots. Rather than simply copying cryptocurrency wallets, the stealer runs an embedded cracker against the wallet vault during the same pass and records the outcome on a WALLET VAULTS CRACKED line in its own report. A direct WlanGetProfileList call dumps every saved Wi-Fi password on the host in plaintext.
A live enrichment pass then reuses the stolen sessions. With the victim’s own authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate a home address. It pulls Uber Eats and DoorDash order history directly, enriches the victim’s Discord profile through the stolen token, and values the Roblox inventory through a live lookup on Rolimons.com. The collected material is assembled locally into a structured evidence bundle containing geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, and iPhone backup indicators, then saved as Identity_Report.txt and serialized as JSON.
The model’s returned assessment is saved as AI_Analysis.txt, and exfiltration can occur in three staged archives: volta_log.zip after the stealer runs, volta_dox.zip after the AI call, and volta_doxnet.zip if the network enrichment produces anything.
The OpenRouter Ranking Stage
The serialized bundle is POSTed to the OpenRouter chat-completions endpoint under a system prompt instructing the model to act as “a forensic intelligence analyst drafting a target assessment.” The required output includes a WHAT THEY’RE WORTH section ranking the victim’s valuables by monetization value across low, medium, and high tiers, and a THEIR OPSEC section assessing the victim’s security posture and password hygiene. The prompt also pushes the model to connect sparse data points, such as linking a victim’s name, address, or university to patterns in their passwords. Talos notes the model is not being asked to find data so much as to draw inferences that extend the value of what was already scraped.
The hardcoded configuration uses anthropic/claude-opus-4.6 as the default model, with a fallback chain of moonshotai/kimi-k2 and then google/gemini-2.5-flash, a temperature of 0.2, and hand-assembled JSON requests with no SDK and a Mozilla/5.0 User-Agent. Talos says the low temperature suggests the operator is emphasizing accuracy and consistency, and describes the cascading chain as a pivot to smaller, more permissive models when refusals occur.
VOLTA checks each model response for refusal phrases such as “I can’t” before moving down a chain of up to three models, and it can run without the LLM stage entirely if no API key is present. The entire inference round-trip runs on the victim’s machine over the victim’s own network connection; only afterward is the result exfiltrated.
Builder Deployment and Countermeasures
Rather than hardcoding its Telegram channel, API keys, and settings, VOLTA is compiled from a template with six swappable slots filled at build time. Talos says this points to a builder model in which the author sells access, buyers supply their own values, and a custom binary is compiled for each order. If that model holds, the analysis notes, the AI dossier is a commercial feature that lets a customer of any sophistication level receive ranked target assessments in a Telegram inbox, rather than a capability the author built for personal use. The slot credentials are encrypted with a key derived as the SHA-256 of two constants sitting in the same binary, which Talos says provides no meaningful protection because anyone who reverses the file can recover them.
Much of VOLTA’s token theft depends on bypassing App-Bound Encryption in Chrome. Talos says an application control policy restricting which processes may launch Chrome with the headless flag would block that decryption path entirely, and at minimum recommends alerting when Chrome launches headless from an unexpected process, along with hardware-backed credential storage. After a compromise, Talos advises preserving the volta_debug.txt file, a timestamped harvest log recording exactly what was collected and whether the LLM call succeeded, then revoking potentially compromised tokens and changing passwords. Any wallet whose seed phrase sat in plaintext on disk should be treated as fully compromised, with funds migrated to a new wallet whose seed is generated on an air-gapped device.
In Talos’s framing, the improvement the AI layer brings is effort displacement rather than speed or scale, the same underlying logic Talos identified in CLOSEDQUORUM, applied to a different phase of the operation. As AI integration in malware matures, the analysis concludes, refusal resilience may become a standard design requirement.
Talos lists the analyzed sample as a PE32+ x86-64 binary with the SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, observed under the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, carrying a PE timestamp of August 17, 2026 and first seen at 12:46 UTC on October 11, 2026.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.