Cybersecurity researchers have identified a new Windows infostealer malware named VOLTA-AUTODOXER (also referred to as VOLTA) that utilizes artificial intelligence (AI) to prioritize victims based on the financial value of their stolen data. This innovative approach marks a significant evolution in malware capabilities, as it enables attackers to efficiently target high-value individuals.
VOLTA is designed to harvest a wide array of sensitive information, including passwords, cookies from Chromium-based browsers, data from Outlook profiles and Slack workspaces, payment card details, cryptocurrency wallet seed phrases, and session tokens from platforms like Discord, Telegram, Steam, and Roblox. Additionally, it collects Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots, creating a comprehensive profile of the victim.
According to Cisco Talos researcher Ryan Fetterman, “VOLTA builds a structured evidence bundle about the person behind the machine.” This bundle includes geolocation data, home addresses, employer information, and even inferred birth years, which are corroborated by searching the victim’s Gmail for receipts from services like Amazon and PayPal.
AI-Driven Analysis and Target Assessment
Once the necessary data is collected, VOLTA serializes the information and submits it to an AI system for analysis. The malware employs OpenRouter, a unified LLM API gateway, to process the data, defaulting to Anthropic’s Claude Opus 4.6. If that model is unavailable, it falls back to alternatives like Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash.
VOLTA’s architecture allows it to switch between models if it encounters refusals, ensuring that it can continue to analyze data effectively. The malware’s system prompt instructs the AI to act as a “forensic intelligence analyst,” generating a target assessment based solely on the structured evidence bundle. This includes a section titled “WHAT THEY’RE WORTH,” which ranks valuables by monetization potential, and “THEIR OPSEC,” assessing the victim’s security posture.
Data Exfiltration and Customization
Data exfiltration occurs in three stages via Telegram:
- Immediately after the malware runs, sending details about browser passwords, cookies, and other sensitive information.
- After the AI analysis, transmitting the captured data along with the results of the LLM assessment.
- Following a live enrichment step, which includes Gmail receipts and order histories.
VOLTA also utilizes a customizable template that includes slots for the Telegram channel used for data exfiltration and API keys, suggesting that the malware author may be offering a builder kit for prospective customers or operating it as a bespoke tool.
Implications of AI in Cybercrime
Fetterman notes that if VOLTA is indeed a commoditized malware, its AI capabilities could be accessible to a wide range of attackers, allowing even less sophisticated individuals to generate ranked target assessments. “VOLTA is a mature stealer with a late-stage AI layer added for one purpose: relieving the operator of analytical work,” he explained.
This development highlights a broader trend in cybercrime, where adversaries are increasingly adopting generative AI technologies to enhance their operations. As noted by Zscaler ThreatLabz, such technologies can be employed to sift through vast amounts of data, identifying the most valuable or sensitive information for theft or encryption.
The emergence of VOLTA underscores the evolving landscape of cybersecurity threats, where AI not only aids attackers in data collection but also streamlines their analytical processes, potentially increasing the success rate of their operations. As this trend continues, organizations must remain vigilant and adapt their defenses to counteract these sophisticated threats.
For further insights, refer to The Hacker News.
