Windows Malware - GoKawiil

VOLTA-AUTODOXER stealer uses LLMs to score stolen victim data for monetization value

Researchers at the CAIRN project identified a Windows infostealer called VOLTA-AUTODOXER that harvests credentials, crypto wallets, session tokens and personal data, then sends a structured profile of the victim to a large language model via OpenRouter. The model is prompted to act as a forensic intelligence analyst and rank how valuable the victim's compromised assets and identity are for further exploitation. The malware self-deletes after operation and has no attacker-controlled infrastructure, relying instead on cloud AI services to do its analysis.

blog.talosintelligence.com · 2026-10-31

Cisco Talos finds ClosedQuorum, a Windows malware that uses AI models to run attacks

Cisco Talos researchers identified a Go-based Windows malware called ClosedQuorum that queries Google Gemini, DeepSeek, Qwen, and Mistral to decide post-compromise actions without human input. The models vote on options such as credential theft, code injection, and persistence, with DeepSeek breaking ties, and stolen data is sent to attackers via a Discord webhook.

bleepingcomputer.com · 2026-09-22

Iranian state hackers deploy CHOSEN BRICK malware against journalists and activists

Cybersecurity agencies from the U.S., U.K. and Netherlands, alongside the FBI, issued a joint advisory exposing an Iranian state-linked campaign using Windows malware called CHOSEN BRICK to spy on dissidents, journalists and activists. Attackers pose as trusted contacts or tech support over WhatsApp and Telegram, luring victims into launching disguised fake apps that secretly install the spyware and evade Windows Defender.

bleepingcomputer.com · 2026-09-16