Volta-Autodoxer infostealer uses Claude Opus 4.6 to profile victims

Infostealers have long been the quiet engine behind major breaches, with recent incidents at AT&T, Ticketmaster and Disney traced back to login details they harvested. What Talos found is that one strain has added a step after collection: compiling the stolen material into a serialized dossier and handing it to a large language model. The prompt is written to look like a forensic intelligence analyst's task, asking for an executive summary of the victim, what they do, what they're worth and a read on their operational security.

The architecture shows attackers planning around model refusals. Volta defaults to Claude Opus 4.6 but cascades to Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash, a pattern Fetterman says reflects cost-effective, older-generation models and an expectation that guardrails might block the first request. The prompt itself is carefully worded not to appear overtly malicious.

Fetterman notes the malware's design may indicate it was built for sale to a range of attackers rather than for one actor's campaigns. The practical effect, he suggests, is that lower-sophistication criminals gain access to more advanced targeting, since authentication tokens expire and passwords can be changed.