Security researchers react to sophistication of VOLTA's attack chain
2 Oct 31 10:29 AM · 12d ago · 1 article · 3 posts · 3 sources · development 2 of 2
The disclosure attracted attention on Hacker News and Mastodon as researchers and security professionals engaged with the report. Commentary noted both the technical sophistication of the attack and its implications for victim exposure.
“Huge props to VOLTA creators. At least you should be comforted that you were pwnd by capable attackers vs hacked by ransomware script kiddies when it happens (note the "when").”
hrbrmstr@mastodon.social, Security researcher (Mastodon) · mastodon ↗Cisco Talos Intelligence Malware researcherCAIRN research effort Research collaborationOpenRouter LLM API service
The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump
Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch
-
first by HN Best, 12d ago · also HN Frontpage
What people said 23 voices · verbatim
-
AI dev environment gets its own SSD. The second SSD stays in, but since it's encrypted there's no way to exfiltrate the data unless you're of interest to nation state attackers. Theoretically the AI could destroy the other SSD but that's what backups are for, and the probability is low because well why would they bother. Boot level malware is…
-
H
Huge props to VOLTA creators. At least you should be comforted that you were pwnd by capable attackers vs hacked by ransomware script kiddies when it happens (note the "when”). https:// blog.talosintelligence.com/app raisal-by-ai-model-driven-victim-prioritization-in-the-volta-infostealer/
-
this is what I do, and it's fairly cheap nowadays if you just buy 2nd hand, I actually go so far as having virtualbox VMs for some of those within the same computer (say I have my "important accounts" computer that has some virtualbox VMs with each a browser with only some of those).Gaming is a windows PC that has only games (so who cares) and a…
-
I'm implementing a 2-computers rule:- 1 computer and Google identity for administrative stuff: Primary accounts for AWS, Google. I also do accounting and have the list of customers. I still don't have any other solution than opening PDFs for the invoices, but it's better than nothing.- 1 computer for programming, with a non-asministrator account…
-
Yea. Fedora has been one of my favorite OS's for years, but exactly what you describe "If one compromised update snuck this guy in.." has spooked me to something with a much slower release cadence. I guess I accept that more unpatched known vulns stick around, but yea when I start thinking about how many software packages -> the number of devs…
-
This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.Makes me want to have…
-
You can thank the npm and the like.Before, people were responsible for the dependencies they were importing.With npm and all the javascripters flooding the market, it became normal to be irresponsible "because everybody is doing it".Fast-forward a couple of years, now everything is web based, even the stand-alone app version. No one knows what is…
-
I have ten desks in < 1000 sqft – to compartmentalize everything.Only one machine is allowed to access google et. al. (my "slop bucket," which gets auto-imaged on every boot).My tax iMac (2006) hasn't been online in two decades.----I've been playing with Docker (for the past month); the idea is cool, but a complete security nightmare; having read…
-
> threat that exfiltratesNo need for something new here, Claude Code (Auto + default settings) has a tendency of running "find"/"ls" on your home folder when it struggles with solving a problem. I wish I was joking.Now of course people trust these AI companies not to do bad things(tm), but all it takes is replacing the model endpoint URL -or any…
-
I know it's a bit insane, but I do daily LTO-6 backups of my workstation. I was able to get a working setup for around $250 since I was willing to work with an "autoloader" drive, but honestly it works great and is really nice peace of mind to have my critical stuff protected. I keep banking to my iPhone these days -- though I can't say it's for…
-
Phase 0: breakins to all (php/python/etc,)Phase 1: the closure, companies close down sites, all banks downPhase 2: the reopen- but to only the correct* sitesPhase 3: the virusesPhase 4: the re-shutdownPhase 5: use of physical currency / fax machines only.We are just getting to Phase 0. By end of 2026 most things will be broken into. By 2027 most…
-
I have been ringing this bell for years.When I first started software, I thought it was the weirdest thing in the world for everyone to go "ok next step, download 1000 different pieces of code from 100 different places."The only thing missing was the financial incentive, and ease of entry... and man if crypto + AI haven't got that combo down.
-
How very considerate! Steal from the rich, not the poor.Conversely, don't bother with poor people!Now we just need proper Robin Hood malware that "levels out the playing field" as it were, by stealing from the rich and moving that money into the poor people's accounts (that have also been hacked).
-
I’ve been thinking about how we’re still in the early days of agents, similar to the early days of the internet, happily opening up our machines and running new protocols.Soon (now?) the threats will become ever more complex, and we’ll be back in the early-2000s-like virus storms.
-
It's an odd choice to run this on the victim's machine (exposing the open router key) rather than on the attacker's infrastructure. I guess this lets them keep it dead simple for buyers, you just need to choose a Telegram channel for the logs to be dumped into.
-
Once ranked, victims can be assigned a proportional token budget so that a high value victim might be targeted with zero days or deepfakes that are more expensive to execute but have passed the desired cost/reward threshold.
-
> There is a new idea in the cybercrime world — cast a wide net, steal everything, and let AI sort out the specifics.This is an old idea just with AI added on top.People even steal physical mail for this reason.
-
kind of boggles me that the big ai labs arent running zero-shot classification on all their outputs with "does this look like any of these bad things we know people get up to"
-
It was gone when people developed the habit of adding a library for adding two integers. I mean I hope that never happened but there isn’t much I would put past the JS/TS crowd.
-
Try QubesOS if you want this, you can have a separate VM for each isolated use-case. The OS itself is a lightweight hypervisor around the VMs (called "Qubes").
-
I almost literally have this, 4 separate devices: 1 machine for gaming, 1 for banking, 1 for general stuff, 1 for 2fa. I consider them all throw-away.
-
Are we going to end up in an arms race where our local records are defensively sprinkled with prompt injection/agent poisoning/tank_man.jpg?
-
If you backtrack the posts here, the warnings were there from various bodies already two or three years ago, but it seems the lag is now being closed.
All 2 developments of Malware VOLTA uses LLMs to rank victims by financial worth →
Hacker NewsNewswiresMastodon