#malware

Cisco Talos describes VOLTA, a self-deleting Windows infostealer that, after taking browser passwords, cookies, payment cards, crypto wallet phrases, chat and gaming sessions, and cloud keys, builds a profile of the victim and sends it to a large language model through OpenRouter. The prompt tells the model to act as "a forensic intelligence analyst drafting a target assessment," with sections on what the victim is worth and how weak their security habits are.

Talos says the malware uses stolen sessions to enrich the profile, for example by searching the victim's Gmail for receipts to confirm a home address and pulling food-delivery order history. Its default model is Anthropic's Claude Opus 4.6; if a response contains refusal phrases such as "I can't," it falls back to Moonshot's Kimi K2 and then Google's Gemini 2.5 Flash, which Talos reads as the author expecting guardrails.

Talos's point: the AI is not writing malware here but doing the criminal's triage, turning a raw credential dump into a prioritized dossier.

GMO Internet's Onamae.com Desktop Cloud, a Japanese virtual private server service marketed for running automated FX trading software, says a third party gained unauthorized access and installed malicious programs in some customers' server environments. Its notice lists 26,739 servers as possibly affected.

To prevent further damage, the company began shutting down customer servers from 04:00 local time on October 21, affecting all Desktop Cloud plans, with no restart date given. BleepingComputer reports the company says data stored on the servers may have been exposed but it has not confirmed misuse, and that payment details are kept on separate infrastructure.

Customers who stored passwords or other secrets on their servers are advised to change them, and the company warns of phishing that may exploit the incident, saying it will never ask for passwords or card numbers by email or phone.