VOLTA malware discovery and AI integration

Cybersecurity researchers at Cisco Talos identified a new Windows-based infostealer malware named VOLTA, also known as VOLTA-AUTODOXER. The malware is designed to harvest sensitive data, including browser passwords, cookies, payment cards, cryptocurrency seed phrases, and active session tokens for platforms like Discord, Telegram, Steam, and Roblox.

What distinguishes VOLTA is its integration of commercial large language models (LLMs) to automate the triage and assessment of victims. After collecting data, the malware sends a structured evidence bundle via the OpenRouter API to AI models, instructing them to act as a “forensic intelligence analyst.” These models evaluate the victim, rank them by financial value, and assess their security habits to help hackers prioritize the most profitable targets.

To enhance its dossiers, the malware performs a second sweep of a victim’s Gmail account, searching for receipts from services such as Amazon, DoorDash, and PayPal to confirm home addresses and lifestyle details. The malware utilizes a multi-model architecture, defaulting to Anthropic’s Claude Opus 4.6, but falling back to Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash if a request is refused. While researchers describe the malware as a mature and sophisticated prototype, they have not yet confirmed widespread use in active attacks in the wild.