New VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial Value
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;
A new AI-driven Windows malware, named VOLTA-AUTODOXER, has been discovered by Cisco Talos research organization. This self-deleting infostealer steals sensitive data from a victim's PC and sends it to Anthropic's Claude AI model to create a target assessment. The malware builds a structured "evidence bundle" containing stolen information such as browser passwords, cookies, saved payment cards, emails, screenshots, and even SSH and cloud-provider configuration files.
It can also switch to other AI models if the primary one refuses or fails, or even opt out of using AI altogether. The stolen data undergoes enrichment with information from the victim's Gmail, order histories from e-commerce platforms, and Roblox item values. The malware then sends the compiled dossier, first to OpenRouter for AI analysis, and then to the attacker via Telegram if no API key is provided for OpenRouter.
This malware appears to be designed for resale, with customizable settings for different customers. Following infection, VOLTA may delete itself but leaves a log file, volta_debug.txt, which contains information about the stolen data and the success of the AI analysis. It is crucial for victims to revoke API keys, rotate tokens, and change passwords after infection, as well as secure any wallets with exposed seed phrases.
The integration of AI in this malware highlights the potential for future developments in malicious AI-assisted cyber threats.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
