VOLTA-AUTODOXER is a self-deleting Windows infostealer that goes beyond collecting credentials: it uses stolen accounts and device data to build a detailed profile of each victim, then asks a large language model to assess what could be monetized. Its haul can include browser passwords and cookies, payment cards, cryptocurrency wallet data, messaging and gaming sessions, Microsoft tokens, SSH and cloud keys, Wi-Fi passwords, and screenshots. Using stolen Gmail, food-delivery, and Discord access, it can add purchase history, corroborated address details, account information, and other evidence. It sends this structured dossier to OpenRouter and requests a concise, citation-backed assessment ranking valuable assets and judging the victim’s security practices.
The AI call is designed to keep working despite refusals: VOLTA tries Claude Opus first, then falls back to Kimi and Gemini, checking responses for refusal language. This indicates that the model’s role is not to help steal data but to replace the operator’s work of interpreting and prioritizing it. The malware also appears built for resale, with customer-specific settings inserted into each compiled copy, and relies on third-party services rather than attacker-owned infrastructure. Defenses include restricting or alerting on unauthorized headless Chrome launches, which can enable credential decryption. After a suspected infection, preserve the timestamped debug log, revoke exposed tokens, change passwords, and move cryptocurrency to a new wallet if its seed phrase may have been exposed.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a critical Linux IPv4 TCP handshake use-after-free, remotely exploitable without authentication and potentially allowing root command execution on servers with multipath TCP listeners. Upstream fixes are available, but Ubuntu and RHEL had not yet shipped patched kernels as of October 29, 2026. (atlasum.net)
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
Cybersecurity startup Cathedral accessed Anthropic’s internal systems in under 12 hours during an authorized security test, exposing employee details, salary information, job offers and internal messages. Its AI agents found weaknesses in business software and accessed meeting transcripts and Slack conversations. (indiatoday.in)
Today's best Hacker News stories, summarized and screenshotted, one email a day.