VOLTA infostealer uses AI to prioritize stolen data

Cybersecurity researchers, including Cisco Talos, have identified a new Windows-based infostealer named VOLTA-AUTODOXER. The malware is notable for its use of Large Language Models (LLMs) to automate the analysis of stolen information.

After harvesting data, VOLTA transmits a profile of the victim to an AI model. This model categorizes the stolen assets into low, medium, and high tiers based on their economic value, a process researchers call “effort displacement.” This allows attackers to prioritize high-value targets with unprecedented speed.

The malware targets a wide array of sensitive information, including passwords, cookies, and payment card details from Chromium-based browsers, as well as data from Firefox, Outlook, and Slack. It specifically targets Microsoft-OAuth tokens, SSH keys, cloud access credentials, and cryptocurrency wallet seed phrases.

Beyond technical credentials, VOLTA builds comprehensive victim profiles by collecting location data, home addresses, employer domains, and even screenshots. It can search Gmail accounts for order histories from services like Amazon, PayPal, and Uber Eats to verify physical addresses and personal details.