VOLTA malware uses AI to rank stolen data by victim value

A Windows infostealer called VOLTA-AUTODOXER is using artificial intelligence to assess the potential value of its victims, according to research from Cisco Talos. After stealing data from an infected computer, the malware creates a structured dossier and sends it to Anthropic’s Claude by default, asking the model to identify and rank assets according to their potential for monetization.

VOLTA can collect browser passwords, cookies, payment-card details, Thunderbird and Outlook profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, SSH files and cloud-provider configurations. It also extracts saved Wi-Fi passwords in plaintext and attempts to crack cryptocurrency wallet vaults rather than simply copying them.

The malware enriches the stolen information through active searches of compromised accounts. It can look through Gmail for receipts from services including Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal to help confirm a home address. It also retrieves delivery histories, uses stolen Discord tokens to expand a victim profile and checks the value of Roblox items through Rolimons.

VOLTA first saves the collected information locally as Identity_Report.txt and in JSON format. It then sends the dossier to OpenRouter, a model-routing service, together with instructions for the AI to act as a forensic intelligence analyst and produce a concise, evidence-backed target assessment. The response is saved as AI_Analysis.txt, and both files are packaged into volta_dox.zip for exfiltration.

Claude Opus 4.6 is configured as the default model with a low temperature setting intended to produce predictable results. If the response appears to contain refusal language or is too limited, the malware can try Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. It can also skip the AI stage entirely when no OpenRouter API key is supplied and send the collected dossier through Telegram instead.

Talos describes VOLTA as a likely resale product. Its builder includes replaceable settings for items such as Telegram channels and API credentials, allowing customized binaries to be created for customers. Although those credentials are encrypted in the binary, researchers say they can be recovered. The design allows a customer to receive ranked victim assessments without depending on infrastructure directly controlled by the attacker.

Much of VOLTA’s Chrome data theft attempts to bypass App-Bound Encryption by launching Chrome in headless mode. Talos says an application-control policy restricting which processes can launch Chrome headless can block this particular decryption route. Such a measure does not prevent the malware from carrying out its other collection, analysis or exfiltration activities.

The main executable may delete itself after infection, but a file named volta_debug.txt should remain. The log can indicate what information was collected and whether the model request succeeded. Talos advises affected users to revoke or rotate exposed API keys and tokens and change their passwords. If a cryptocurrency wallet’s seed phrase was stored in plaintext, its funds should be transferred to a new wallet with a freshly generated seed.

Sources: Tom's Hardware.