Executive Summary
Cybersecurity researchers have identified a new Windows-based infostealer, VOLTA-AUTODOXER (VOLTA), which represents a shift in adversary tradecraft by integrating Generative AI for automated victim analysis. The malware harvests standard credentials, browser data, and session tokens, but differentiates itself by using a multi-model AI architecture (Claude, Kimi, and Gemini) via the OpenRouter API. This AI layer acts as a virtual triage analyst, ranking victims into monetization tiers and assessing their security posture based on a structured 'evidence bundle.'
Additionally, a related framework named NIK C2 has been discovered, which employs 'LLMjacking' by searching for victim-owned OpenAI API keys to fund its own malicious inference tasks. These developments indicate that threat actors are increasingly using AI not just for scale, but to automate the high-level analytical work previously performed manually by human operators.
This trend significantly shortens the window between initial infection and targeted exploitation. By automating the identification of high-value assets (such as cryptocurrency, employer domains, and Slack access), attackers can prioritize their efforts on the most profitable targets with minimal manual intervention.