Came across this on TokenPost / Cisco Talos: the Windows information-stealing trojan VOLTA-AUTODOXER scans browser credentials, payment cards, and crypto wallet seed phrases, and can even try to crack local wallet vaults.
Even sneakier is its optional AI stage—it sends victim profiles to OpenRouter, using Claude Opus 4.6 by default, and switches to Kimi K2 / Gemini 2.5 Flash if rejected. It asks the model to sort “valuable stuff” into low / medium / high tiers and assess your security habits, too. Researchers say the model acts as the operator’s triage analyst; it can steal without AI, too. If your seed phrase is stored in plaintext on disk, consider the whole wallet compromised.
Talos spotted samples on 10/11 and published its analysis on 10/31; so far, real-world victim infections haven’t been confirmed. Don’t let your seed phrase touch disk.
#安全 #AI #Crypto
Even sneakier is its optional AI stage—it sends victim profiles to OpenRouter, using Claude Opus 4.6 by default, and switches to Kimi K2 / Gemini 2.5 Flash if rejected. It asks the model to sort “valuable stuff” into low / medium / high tiers and assess your security habits, too. Researchers say the model acts as the operator’s triage analyst; it can steal without AI, too. If your seed phrase is stored in plaintext on disk, consider the whole wallet compromised.
Talos spotted samples on 10/11 and published its analysis on 10/31; so far, real-world victim infections haven’t been confirmed. Don’t let your seed phrase touch disk.
#安全 #AI #Crypto
