Cisco Talos said in a blog post dated 31 October 2026 that a self-deleting Windows infostealer that names itself VOLTA-AUTODOXER (VOLTA) harvests browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles and screenshots, then builds a structured evidence bundle about the victim and uses stolen session access to search the victim's Gmail for purchase receipts to corroborate a home address.

Talos says the bundle is POSTed to OpenRouter with a system prompt telling the model to act as "a forensic intelligence analyst drafting a target assessment", with output sections ranking valuables by monetization and assessing the victim's security posture.

Talos says the hardcoded default model is anthropic/claude-opus-4.6, with a fallback chain of moonshotai/kimi-k2 then google/gemini-2.5-flash if a response looks like a refusal. (source: Cisco Talos)