“VOLTA-AUTODOXER,” described by Talos on 31 October, harvests browser credentials, service sessions, SSH and cloud keys and wallets, then sends the bundle via OpenRouter to Anthropic's top model cast as an analyst drafting a target assessment, falling back to Moonshot's Kimi and then Google's Gemini when it detects refusal phrases. The output is saved as a document with sections on worth and operational weaknesses, and ranked dossiers appear to be sold via Telegram. The sample was first seen on 11 October, and no government or defence victims have been identified.
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-10-31）「Cisco Talos、盗んだ情報をフロンティアモデルに格付けさせる情報窃取マルウェアを報告 拒否されると別モデルへ切替」『AI & Security Observatory』、第1.0版、最終更新2026-11-02。https://ai-security-observatory.org/ja/brief/brief-20261102-11/
AI & Security Observatory (2026-10-31). Cisco Talos reports an infostealer that has frontier models appraise stolen data to rank victims, switching models when refused . AI & Security Observatory, version 1.0. Updated 2026-11-02. https://ai-security-observatory.org/en/brief/brief-20261102-11/
Version 1.0 · Publication date 31 Oct 2026 · Updated 2 Nov 2026
Revision history
- Earlier revisions have not been recorded.