If your staff keep AI API keys on their machines or reach LLM gateways from work laptops, you now have two new things to defend: the keys themselves and the outbound traffic they generate. Two Windows threats described by Cisco Talos use language models to sort stolen data, and one of them bills the victim for the analysis. Detection rules built for classic stealers may miss both behaviours.
What happened
According to The Hacker News, citing Talos researcher Ryan Fetterman, a Windows infostealer called VOLTA-AUTODOXER (VOLTA) assembles a profile of the person behind each infected machine. It includes location and home address, employer, an inferred birth year, card last-4 digits, Slack workspaces, iPhone backup indicators and a live Roblox account valuation. It also uses stolen session access to search Gmail for retail, delivery and payment receipts that corroborate the home address.
VOLTA sends that bundle through OpenRouter, an LLM API gateway, with a 240-word system prompt that casts the model as a forensic intelligence analyst. The output ranks the victim’s assets by monetisation value and assesses their password habits. Requests default to Claude Opus 4.6 and fall back to Kimi K2 and Gemini 2.5 Flash if a model refuses. Exfiltration runs over Telegram. Talos says a build-time template suggests the author either sells a builder kit or compiles custom binaries per order.
Talos also detailed NIK C2 last week, a Go-based remote access tool with more than 52 commands and an OpenAI client. If the operator supplies no key, it searches the victim’s environment variables for OPENAI_API_KEY and uses that, so the victim pays for the attacker’s inference.
Why it matters
Talos frames VOLTA’s AI layer as effort displacement rather than speed or scale. The likely effect is a lower skill bar: a buyer of a commodity stealer gets ranked target assessments in a Telegram inbox without doing the analysis. That helps criminals decide who to extort, defraud or sell on, and fast.
NIK C2 points to a second shift. Talos says it collapses collection and exploitation into one continuous session, removing the offline processing delay that once gave defenders time to detect. Zscaler ThreatLabz adds that GenAI suits searching large data sets, which a ransomware actor could use to find the most sensitive files in a network and raise the odds of payment.
Using a victim’s key is a form of LLMjacking. It shifts cost to the victim and, per Talos, obscures who made the requests. The fallback chain in VOLTA also shows that model refusals are a weak control once an attacker can route around them.
What it means for you
Start with exposure. Audit where AI keys live on endpoints, including environment variables, and move them into a secrets manager with short-lived, scoped credentials. Set spend limits and usage alerts on every provider account, since an unexplained bill or a request spike may be the first sign of key theft.
Next, detection. Review egress rules and proxy logs for traffic to LLM gateways such as OpenRouter from hosts with no business reason to call them. Flag Telegram traffic from corporate endpoints. Ask your EDR vendor whether it covers stealers that read browser sessions and then query mail for receipts, and how it handles Go-based remote access tools.
Finally, reduce what a stealer can monetise. Enforce session lifetimes and device-bound sessions for mail and chat, keep personal and work browser profiles apart, and brief staff that infection exposes personal data as well as company data. For a broader look at trusting your tooling, see our piece on security tools running as root, and follow our cybersecurity coverage.
What to watch
- Whether VOLTA appears in criminal markets as a builder kit, which would confirm the commodity model Talos suspects.
- Whether gateways and model providers add abuse controls or key-binding features that make stolen keys harder to use.
- Other families copying the victim-key fallback seen in NIK C2.
- Vendor detections aimed at LLM API calls made from compromised hosts.
