Cisco Talos discovers VOLTA malware using AI to rank victims

Cybersecurity researchers at Cisco Talos have identified a new Windows infostealer malware named VOLTA-AUTODOXER, or VOLTA. The malware is designed to harvest a wide range of sensitive data, including browser passwords, cookies, payment cards, cryptocurrency seed phrases, and active sessions for platforms such as Discord, Telegram, Steam, and Roblox.

What distinguishes VOLTA is its use of commercial large language models (LLMs) to automate the triage process. After collecting data, the malware compiles a structured evidence bundle and sends it via the OpenRouter API to AI models to act as a “forensic intelligence analyst.” The system prompt instructs the AI to evaluate the victim, rank them by financial value, and assess their security habits.

To increase the accuracy of its dossiers, the malware performs a second sweep of the victim’s Gmail account, searching for receipts from services like Amazon, DoorDash, and PayPal to confirm home addresses and lifestyle details. The malware utilizes a multi-model architecture to ensure success: it defaults to Anthropic’s Claude Opus 4.6, but if the model refuses the request, it automatically falls back to Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash.

While the malware is considered a mature and sophisticated prototype, Talos researchers noted they have not yet confirmed widespread use in active attacks in the wild.