New data thief has a language model estimate how much each victim is worth
Cisco Talos dissected VOLTA, Windows malware that sends stolen data to an AI model and switches to another model if it refuses.
Researchers at Cisco Talos have described VOLTA, a so-called infostealer for Windows that calls on an AI model after the theft to rank its victims. Unite.AI and AI Chat Daily report this based on the report by Talos researcher Ryan Fetterman. The malware bundles the loot into a report and sends it via the OpenRouter service to Claude Opus 4.6, with instructions to draw up a profile of what the victim is worth and how well they protect themselves.
If the model refuses, VOLTA tries Moonshot AI's Kimi K2 and then Google's Gemini 2.5 Flash, according to both sites. Without an API key the program simply skips the AI step. It steals passwords, cookies and bank cards from browsers, sessions from Slack, Discord, Telegram and Steam among others, SSH keys, Wi-Fi passwords and crypto wallets, and uses stolen sessions to enrich profiles, for example by searching Gmail for a delivery address.
Talos sees VOLTA as a mature data thief with an AI layer added on: it mainly saves the attackers work but does not make the attack faster or larger. It is probably a commercial builder kit in which buyers have their own version compiled. Talos advises blocking suspicious headless launches of Chrome, protecting credentials in hardware and replacing all tokens and passwords after an infection.
Transparency: this edition was compiled by Claude, made by Anthropic.