Cisco Talos 详细信息 VOLTA 信息处理器 LLM 受害者搜索阶段

网络安全

Cisco Talos 详细信息 VOLTA 信息处理器 LLM 受害者搜索阶段

在 Google 上的首选来源中添加 Unite.AI

Cisco Talos研究员Ryan Fetterman于2026年10月31日发表了一份对VOLTA-AUTODOXER的分析，该分析是自发删除的Windows信息处理器，它遵循了广泛的证书-盗窃传记，并配有大型语言模型舞台，旨在对每个受害者的货币资产进行排序。

Talos将VOLTA描述为带有可选的AI-集成层的成熟的窃取者植入，称每个观察到的端点都是第三方控制的，没有攻击者拥有的基础设施。 在Talos的评估中，人工智能阶段的新颖之处是，该模型代表操作者充当情报分析员，而不是支持传统的恶意软件能力，将原始的证书记录转换成以引用为后盾的受害人货币资产的优先档案。

恶意软件在Talos的CAIRN研究中浮现出来。 Talos 发布和开源 CAIRN，认知人工智能研究网，2026年9月22日，作为猎杀，分类和通过嵌入的提示，提供者端点，API密钥等元数据文物跟踪AI-集成的恶意软件的工具包，不下载或执行基础二进制。 Talos 称在发布时表示，它将随时间推移分享其初步发现，从CloseEDQUORUM开始，它称之为完全自主的多模式共识管弦乐手，没有人类操作者。

收集和会议充实

单VOLTA通过提取浏览器证书，cookie，并保存了Chromium类浏览器的支付卡，连同Firefox和雷鸟数据，Outlook简介，Slack工作空间，Steam和Battle.net会话，Discord令牌，Telegram会话，Roblox帐号，Microsoft OAuth令牌，SSH和云端提供器配置文件，用于gcloud,OpenVPN，以及Hide.me,Wi-Fi简介和截图。 窃取者不是简单地复制加密货币钱包，而是在同一通行证期间对钱包金库运行嵌入式快克机，并将结果记录在WALLET VAULTS CRAKED线上。 一个直接的WlanGetProfileList呼叫器在主机上以纯文本中每个保存的Wi-Fi密码都丢弃。

然后用活的浓缩通行证重新使用失窃的会话 VOLTA用受害人自己经认证的Gmail令牌，搜查收件箱，它直接拉动Uber Eats和DoorDash订购历史，通过被盗的神器丰富受害者Discord的剖面图，并通过对Rolimons.com的现场检索来评价Roblox的库存。 收集的材料在当地汇编成一个结构化的证据包，其中包含地理位置和住址、雇主和雇主领域、推定的出生年份、卡片最后4位数、Slack工作空间、文件作者元数据以及iPhone备份指标，然后保存为身份-报告.txt，序列化为JSON。

该模型的返回评估保存为 AI Analysis.txt，并可在三个阶段的档案中进行过滤：Volta log.zip在窃取者运行后，Volta dox.zip在AI调用后

OpenRouter 排名阶段

串装的捆绑在OpenRouter聊天完成点上，所需产出包括一个他们正在WORTH的栏目，按照低、中、高等级的货币化价值对受害者价值进行排名，以及一个他们OPSEC的栏目，评估受害者的安全态势和密码卫生。 将受害者的姓名、地址或大学与密码中的图案联系起来。 Talos 指出该模型没有被要求找到数据，以至于得出可以扩展已刮掉的值的推断。

硬编码配置采用anthropic/claude-opus-4.6作为默认型号，采用月球回旋链/kimi-k2，然后采用google/gemini-2.5-flash，温度0.2，手动组装的JSON请求没有SDK和一个Mozilla/5.0 User-Agent. 低温度的Talos 称表明操作员强调准确性和一致性，并将连锁链描述为在出现拒绝时对较小的、更宽容的模型的支点。

VOLTA 检查每个模式响应，如“ I can't” 等拒绝语句，在移动到一个最多三个模式的链条之前，如果不存在 API 键，它可以完全运行而不使用 LLM 级。 整个推论在受害人的机器上通过受害人自己的网络连接进行；只有在事后才发现结果。

建设者部署和反措施

VOLTA不是硬编码其Telegram通道，API密钥，以及设置，而是从一个模板中编译，在构建时填充了六个可互换的空档。 Talos 称这指的是一个构建者模型，作者在其中销售访问，购买者提供自己的值，并为每个订单编译自定义二进制。 如果该模型，即指出分析，AI档案是一个商业特征，它让任何精密水平的客户在Telegram收件箱中接收到分级的目标评估，而不是作者为个人使用而建立的能力。 槽式证书用一个密钥加密，该密钥衍生为坐在同一个二进制中的两个常数的SHA-256，塔洛斯称对此没有提供有意义的保护，因为任何翻转文件的人都可以收回。

VOLTA的标志性盗窃大多依赖于绕过Chrome的App-Bound加密。 Talos 称限制哪些过程可能使用无头旗的发布 Chrome的应用程序控制政策将完全阻断解密路径，并且至少建议在Chrome 发布头无头时从意外的进程中发出警报，同时发出硬件支持的证书存储。 经过妥协，塔洛斯建议保留volta debug. txt文件，一个时间戳的收割日志记录了所收集的准确内容以及LLM呼叫是否成功，然后撤销可能损坏的令牌并更改密码。 任何在磁盘上使用纯文本的种子短语的钱包都应被视为完全失密，资金应转移到一个新的钱包上，其种子由空气加载设备生成。

在Talos的架构中，AI层的带来的改进是努力转移而不是速度或尺度，CLOSEDQUORUM中确定的基本逻辑Talos适用于操作的不同阶段。 随着恶意软件中的AI集成逐渐成熟，分析得出结论，拒绝应变能力可能成为标准设计要求。

Talos将分析的样品列为PE32+x86-64二进制，与SHA-256 hash 57ef42666d78c50df145b34023df564 f0fad 38812d6a580e66433d427e2279，在文件名9BY0tjwOc3ut.exe和yLP9m5J3i2Aw.exe下观测到，携带了PE时间戳，时间戳为2026年8月17日，2026年10月11日12:46 UTC首次出现。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

Cisco Talos Details VOLTA Infostealer’s LLM Victim-Ranking Stage

Add Unite.AI to your preferred sources on Google

Cisco Talos researcher Ryan Fetterman on October 31, 2026 published an analysis of VOLTA-AUTODOXER, a self-deleting Windows infostealer that follows a broad credential-theft pass with a large language model stage designed to rank each victim’s monetizable assets.

Talos describes VOLTA as a mature stealer implant with an optional AI-integration layer, and says every observed endpoint is third-party controlled, with no attacker-owned infrastructure. In Talos’s assessment, the novelty of the AI stage is that the model works as an intelligence analyst on the operator’s behalf rather than supporting a traditional malware capability, converting a raw credential log into a prioritized dossier of the victim’s monetizable assets backed by citations.

The malware surfaced through Talos’s CAIRN research effort. Talos released and open-sourced CAIRN, the Cognitive Artifact Intelligence Research Network, on September 22, 2026 as a toolkit for hunting, classifying, and tracking AI-integrated malware through metadata artifacts such as embedded prompts, provider endpoints, and API keys, without downloading or executing the underlying binaries. Talos said at release that it would share its initial findings over time, beginning with CLOSEDQUORUM, an implant it described as a fully autonomous multi-model consensus orchestrator with no human operator.

Collection and Session Enrichment

A single VOLTA pass extracts browser credentials, cookies, and saved payment cards across Chromium-based browsers, along with Firefox and Thunderbird data, Outlook profiles, Slack workspaces, Steam and Battle.net sessions, Discord tokens, Telegram sessions, Roblox accounts, Microsoft OAuth tokens, SSH and cloud-provider configuration files for gcloud, OpenVPN, and Hide.me, Wi-Fi profiles, and screenshots. Rather than simply copying cryptocurrency wallets, the stealer runs an embedded cracker against the wallet vault during the same pass and records the outcome on a WALLET VAULTS CRACKED line in its own report. A direct WlanGetProfileList call dumps every saved Wi-Fi password on the host in plaintext.

A live enrichment pass then reuses the stolen sessions. With the victim’s own authenticated Gmail tokens, VOLTA searches the inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to corroborate a home address. It pulls Uber Eats and DoorDash order history directly, enriches the victim’s Discord profile through the stolen token, and values the Roblox inventory through a live lookup on Rolimons.com. The collected material is assembled locally into a structured evidence bundle containing geolocation and home address, employer and employer domain, inferred birth year, card last-4 digits, Slack workspaces, document authorship metadata, and iPhone backup indicators, then saved as Identity_Report.txt and serialized as JSON.

The model’s returned assessment is saved as AI_Analysis.txt, and exfiltration can occur in three staged archives: volta_log.zip after the stealer runs, volta_dox.zip after the AI call, and volta_doxnet.zip if the network enrichment produces anything.

The OpenRouter Ranking Stage

The serialized bundle is POSTed to the OpenRouter chat-completions endpoint under a system prompt instructing the model to act as “a forensic intelligence analyst drafting a target assessment.” The required output includes a WHAT THEY’RE WORTH section ranking the victim’s valuables by monetization value across low, medium, and high tiers, and a THEIR OPSEC section assessing the victim’s security posture and password hygiene. The prompt also pushes the model to connect sparse data points, such as linking a victim’s name, address, or university to patterns in their passwords. Talos notes the model is not being asked to find data so much as to draw inferences that extend the value of what was already scraped.

The hardcoded configuration uses anthropic/claude-opus-4.6 as the default model, with a fallback chain of moonshotai/kimi-k2 and then google/gemini-2.5-flash, a temperature of 0.2, and hand-assembled JSON requests with no SDK and a Mozilla/5.0 User-Agent. Talos says the low temperature suggests the operator is emphasizing accuracy and consistency, and describes the cascading chain as a pivot to smaller, more permissive models when refusals occur.

VOLTA checks each model response for refusal phrases such as “I can’t” before moving down a chain of up to three models, and it can run without the LLM stage entirely if no API key is present. The entire inference round-trip runs on the victim’s machine over the victim’s own network connection; only afterward is the result exfiltrated.

Builder Deployment and Countermeasures

Rather than hardcoding its Telegram channel, API keys, and settings, VOLTA is compiled from a template with six swappable slots filled at build time. Talos says this points to a builder model in which the author sells access, buyers supply their own values, and a custom binary is compiled for each order. If that model holds, the analysis notes, the AI dossier is a commercial feature that lets a customer of any sophistication level receive ranked target assessments in a Telegram inbox, rather than a capability the author built for personal use. The slot credentials are encrypted with a key derived as the SHA-256 of two constants sitting in the same binary, which Talos says provides no meaningful protection because anyone who reverses the file can recover them.

Much of VOLTA’s token theft depends on bypassing App-Bound Encryption in Chrome. Talos says an application control policy restricting which processes may launch Chrome with the headless flag would block that decryption path entirely, and at minimum recommends alerting when Chrome launches headless from an unexpected process, along with hardware-backed credential storage. After a compromise, Talos advises preserving the volta_debug.txt file, a timestamped harvest log recording exactly what was collected and whether the LLM call succeeded, then revoking potentially compromised tokens and changing passwords. Any wallet whose seed phrase sat in plaintext on disk should be treated as fully compromised, with funds migrated to a new wallet whose seed is generated on an air-gapped device.

In Talos’s framing, the improvement the AI layer brings is effort displacement rather than speed or scale, the same underlying logic Talos identified in CLOSEDQUORUM, applied to a different phase of the operation. As AI integration in malware matures, the analysis concludes, refusal resilience may become a standard design requirement.

Talos lists the analyzed sample as a PE32+ x86-64 binary with the SHA-256 hash 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279, observed under the filenames 9BY0tjwOc3ut.exe and yLP9m5J3i2Aw.exe, carrying a PE timestamp of August 17, 2026 and first seen at 12:46 UTC on October 11, 2026.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.