VOLTA malware uses AI to assess victim profitability

Cybersecurity researchers at Cisco Talos have identified a new Windows-based infostealer malware named VOLTA. The malware distinguishes itself by integrating large language models (LLMs) to analyze stolen data and determine the financial value of its targets.

VOLTA harvests a wide array of sensitive information, including browser passwords, cookies, cryptocurrency wallet seed phrases, payment card details, and session tokens for platforms such as Discord, Telegram, and Steam. It also collects geolocation data, employer information, and document metadata.

According to researchers, the malware performs a live enrichment pass by using stolen session access to deep-dive into victim data. For instance, it can query a victim's Gmail for purchase receipts from services like Amazon or DoorDash to confirm home addresses and order histories. This structured evidence is then sent to AI models via OpenRouter with instructions to act as a forensic intelligence analyst. The AI generates a target assessment that ranks victims by their financial worth into categories such as low, medium, or high, allowing hackers to prioritize the most profitable targets.