# VOLTA malware discovery and AI integration

> Developing situation record from CLSTR: https://clstr.news/situations/volta-malware-discovery-and-ai-integration
> Updated: 2026-11-02T12:22:48.000Z. Sources: 19. Developments: 2.

Cybersecurity researchers at Cisco Talos identified a new Windows-based infostealer malware named VOLTA, also known as VOLTA-AUTODOXER. The malware is designed to harvest sensitive data, including browser passwords, cookies, payment cards, cryptocurrency seed phrases, and active session tokens for platforms like Discord, Telegram, Steam, and Roblox.

What distinguishes VOLTA is its integration of commercial large language models (LLMs) to automate the triage and assessment of victims. After collecting data, the malware sends a structured evidence bundle via the OpenRouter API to AI models, instructing them to act as a “forensic intelligence analyst.” These models evaluate the victim, rank them by financial value, and assess their security habits to help hackers prioritize the most profitable targets.

To enhance its dossiers, the malware performs a second sweep of a victim’s Gmail account, searching for receipts from services such as Amazon, DoorDash, and PayPal to confirm home addresses and lifestyle details. The malware utilizes a multi-model architecture, defaulting to Anthropic’s Claude Opus 4.6, but falling back to Moonshot AI’s Kimi K2 or Google’s Gemini 2.5 Flash if a request is refused. While researchers describe the malware as a mature and sophisticated prototype, they have not yet confirmed widespread use in active attacks in the wild.

## Timeline

### 2026-11-02: VOLTA malware uses AI to assess victim profitability

A new Windows malware called VOLTA uses AI to analyze stolen personal data and rank victims based on their potential financial value to hackers.

7 sources. https://clstr.news/cluster/volta-malware-uses-ai-to-assess-victim-profitability

### 2026-10-31: Cisco Talos discovers VOLTA malware using AI to rank victims

Cisco Talos has discovered VOLTA-AUTODOXER, a Windows malware that uses AI models like Claude and Gemini to automatically profile victims and rank them by their financial value to cybercriminals.

13 sources. https://clstr.news/cluster/volta-autodoxer-malware-uses-ai-to-create-victim-dossiers

---
Cite as: VOLTA malware discovery and AI integration. CLSTR, https://clstr.news/situations/volta-malware-discovery-and-ai-integration